Malicious PDF — malware analysis report

Static analysis result for SHA-256 016775130982d5e4…

MALICIOUS

PDF

78.9 KB Created: 2021-03-06 16:28:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3f3ef8a9d90c8074e49cec8ca251b5e8 SHA-1: 5add7c9817778fe0a6da221d313bf28d423127aa SHA-256: 016775130982d5e4b125194dad810d7efa2428c91d0fb66cfe338eddedd3078a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The PDF contains a large number of external links, indicating it functions as a link farm. One of the primary URLs identified is https://druttle.ru/aws?utm_term=how+many+red+cards+in+a+deck, which is likely part of a phishing or SEO manipulation scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/aws?utm_term=how+many+red+cards+in+a+deck
    • https://murafasonuralab.weebly.com/uploads/1/3/5/3/135398902/06da5a804983.pdf
    • https://cdn.sqhk.co/xoxamomajil/Zhejagc/kingdom_builders_toys.pdf
    • https://zipebamaxotunev.weebly.com/uploads/1/3/2/8/132814247/wojejajezut-kupujuzakebux-muwogigigijamog.pdf
    • https://tebudewuve.weebly.com/uploads/1/3/2/6/132683230/dagedonoxexi.pdf
    • https://cdn.sqhk.co/vasibejovej/djficjb/godejitate.pdf
    • https://cdn.sqhk.co/xamitarerivu/hebiduU/matchington_mansion_hack_no_human_verification_ios.pdf
    • https://susudomi.weebly.com/uploads/1/3/5/3/135319884/vukebenewagozori.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/lolaritemukole/intelligence_information_report_example.pdf
    • https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_fb8985f3d361442a86d983cda0143edc.pdf?index=true
    • https://ca483b97-61ac-4196-bca0-6b249c18eca9.filesusr.com/ugd/b27199_97a5d56704844f30a0781587b4277143.pdf?index=true
    • https://74fc1a11-d445-4ffb-bc6b-7a79e5a65a18.filesusr.com/ugd/097bd5_57c232d213244de7a2990c66dbb5ed13.pdf?index=true
    • https://21d44941-995c-48b9-956b-8145330e20d5.filesusr.com/ugd/577b75_129e80b510d242e68b145d580ee0a314.pdf?index=true
    • https://s3.amazonaws.com/rumezo/38836953684.pdf
    • https://uploads.strikinglycdn.com/files/323d52d4-98ea-4049-a805-b0b323e46537/kill_team_commanders_review.pdf
    • https://uploads.strikinglycdn.com/files/fc50daa7-6c8e-4d44-964a-f955de708431/reported_missing_season_2_episode_2.pdf
    • https://uploads.strikinglycdn.com/files/aa406e39-d18d-4fc7-a960-95b75d82574e/missingmaker_files_office_2016.pdf
    • https://3633ae4e-9acc-45df-885e-1bfa1481cb44.filesusr.com/ugd/e73054_f060fc16ba1040fbbc0eec04e617bf8f.pdf?index=true
    • https://s3.amazonaws.com/rexogeguxosix/peaky_blinders_imdb_parents_guide.pdf
    • https://uploads.strikinglycdn.com/files/70b12334-79c0-4826-851d-e8573febb23d/bezogovazapegid.pdf
    • https://uploads.strikinglycdn.com/files/a39fa0ec-2917-4310-9002-80205925d0c3/totaline_thermostat_setup.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb54.bin
19b3972e3fbba6abddf96ec0be8931cdad9d4266b729d57f06ae51d2104259a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB54 4980 bytes
font_01_sfnt_off0000fc2a.bin
7848346d8040e6191f6e85c60fd4b572202d7ab5888e9f7b80e3fc9906584425		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC2A 10656 bytes
font_02_sfnt_off00012061.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12061 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.