Malicious PDF — malware analysis report

Static analysis result for SHA-256 053498dc92110ec2…

MALICIOUS

PDF

83.6 KB Created: 2021-03-23 12:33:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f3080dea600689992ed877a4bcb09c4b SHA-1: dc9a53e8cbca30bf90e9102baded01d2596298ce SHA-256: 053498dc92110ec2350fa17143cb167b2a44dc7810f7d9093283dbde0bb56872
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. It contains a large number of external links, with one pointing to 'https://seumenha.ru/award?keyword=autostoperski+vodic+kroz+galaksiju+pdf+download', suggesting a link farm or phishing attempt. The PDF structure and embedded links are indicative of an attempt to redirect users to malicious sites or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=autostoperski+vodic+kroz+galaksiju+pdf+download
    • https://cdn-cms.f-static.net/uploads/4417658/normal_6046e40657abb.pdf
    • http://sollabs.xyz/476297336228dgw3.pdf
    • https://cdn-cms.f-static.net/uploads/4377128/normal_60464efbaf0e2.pdf
    • http://gerda-msk.ru/shark_rotator_professional_lift-away_upright_vacuum_reviewsek2f2.pdf
    • http://creditinquiry.info/29393705337sl2nt.pdf
    • https://cdn-cms.f-static.net/uploads/4485299/normal_60143de07f12f.pdf
    • https://cdn-cms.f-static.net/uploads/4404313/normal_60277d9f3b699.pdf
    • https://cdn-cms.f-static.net/uploads/4404503/normal_605949095948c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/31008995-0600-4edf-ac35-cfd383b547db/after_anna_todd_book_online.pdf
    • https://uploads.strikinglycdn.com/files/cb360e24-3fcd-42a9-8a61-09d3f5b54437/bomavatibewibonunak.pdf
    • https://uploads.strikinglycdn.com/files/27f0af07-937b-4745-bea6-6775e46491a4/rufunemiwewizon.pdf
    • https://uploads.strikinglycdn.com/files/da1dab2b-654a-4f17-93fa-5ce3c62fbea4/obdlink_lx_iphone.pdf
    • https://uploads.strikinglycdn.com/files/6a0daddc-cb49-4e57-8995-e70f68ad7b3e/9901069210.pdf
    • https://uploads.strikinglycdn.com/files/d8c4ea04-94f2-4a51-affa-1d081c4a22a3/3875202282.pdf
    • https://uploads.strikinglycdn.com/files/42c7505e-fa69-4fe5-ad67-a2c032c50464/barrons_ap_english_language_and_composition_flashcards.pdf
    • https://uploads.strikinglycdn.com/files/a0ca75d6-82b9-41ca-9d1f-125bce323b62/cards_against_humanity_online_app_with_friends.pdf
    • https://uploads.strikinglycdn.com/files/ec6d07a6-1893-4669-9676-7eb063ef797d/33820986297.pdf
    • https://b3a1a1c9-4f8f-4fb8-b7cc-7339030cc889.filesusr.com/ugd/162fe6_c8b2a21f4a104562b545995e942e553a.pdf?index=true
    • https://a3de454e-1598-42bb-a259-4eb69c42f179.filesusr.com/ugd/fb5067_38767687e031446d9553da5006062780.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1cb.bin
e41c80039fc4ee2b661c7da4fb686f3daa15c11f87693758b6dfcd2db84d45a7
pdf-font-stream PDF embedded font (sfnt) at offset 0xF1CB 5656 bytes
font_01_sfnt_off0001053e.bin
9d294345ef77bfa7538916816fe8248c916c78a1be4b1ca4b857ccc4a1e40dda
pdf-font-stream PDF embedded font (sfnt) at offset 0x1053E 11500 bytes
font_02_sfnt_off00012bb7.bin
e9fe716c2abc985b12a899a49d5539e4e8be1b56d50c083b30290d85a2a7c848
pdf-font-stream PDF embedded font (sfnt) at offset 0x12BB7 16092 bytes