Malicious PDF — malware analysis report

Static analysis result for SHA-256 0df97ac573c330ef…

MALICIOUS

PDF

72.1 KB Created: 2021-05-03 00:44:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c7295be413c82f26183c9dbcc1bacefe SHA-1: a9b96039bee26f19e901618df3d151413e9a529e SHA-256: 0df97ac573c330efcd6132a41fd693929d3367c24f313805d07a7d025d041c41
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with the primary one leading to a URL associated with a search query for a free book download. Heuristics indicate a link farm and ClamAV detected it as a phishing trojan. The presence of embedded JavaScript, though not explicitly detailed in the provided evidence, is a common method for exploiting PDF vulnerabilities or redirecting users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=diary+of+a+wimpy+kid+the+meltdown+epub+free+download
    • http://vatidenow.medianewsonline.com/convert_to_autocad_dwg_online_free_without_email.pdf
    • https://cdn-cms.f-static.net/uploads/4496592/normal_6021512c6d90a.pdf
    • https://jinikegubu.weebly.com/uploads/1/3/4/8/134873825/memujobuxedoxav.pdf
    • https://lizifonaw.weebly.com/uploads/1/3/2/3/132302762/lepimozo.pdf
    • http://nakozek.mypressonline.com/nadina.pdf
    • https://gekafokolasiga.weebly.com/uploads/1/3/1/3/131384301/c4662.pdf
    • https://cdn-cms.f-static.net/uploads/4380545/normal_6069c4f6a2911.pdf
    • http://mewudaguzexo.sportsontheweb.net/golden_brown_song_meaning.pdf
    • http://wejuzofibab.medianewsonline.com/sopazogatoxomanijevim.pdf
    • http://famixadip.22web.org/19067466842.pdf
    • https://pekizexigobuton.weebly.com/uploads/1/3/0/8/130815014/79c69825e0beaf9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://nilifujajug.epizy.com/manupirev.pdf
    • https://49550882-97ce-44db-a38b-6e383bb81149.filesusr.com/ugd/062c90_858dd1272de64bb3965ca34112aeeb49.pdf?index=true
    • https://6c639bf1-704a-4500-b661-329758898742.filesusr.com/ugd/02d620_00cdcd0857e442da90c54c37a365012c.pdf?index=true
    • http://lawosavamog.rf.gd/34686021003.pdf
    • https://4f65501f-cdae-4966-b9db-49b15ad9d196.filesusr.com/ugd/52b593_280dfa30214a4334a83c2be3f7bd8f97.pdf?index=true
    • http://bejulebekafa.rf.gd/murudu.pdf
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_f136eba84dd645aca4d49d475b895069.pdf?index=true
    • https://c84d532c-3b33-47d6-96aa-4134a1164eb1.filesusr.com/ugd/6d45f6_c26394d9c3154d0db9ee4f6ae6e9d4b1.pdf?index=true
    • http://mulagokonud.rf.gd/can_emergency_powers_override_the_constitution.pdf
    • https://8f6f9f04-f977-4239-955d-f6aecf2dd879.filesusr.com/ugd/81cd61_d77573334aab40f185f76adb4576786b.pdf?index=true
    • https://3568c1c9-c281-4b9a-9ea9-d5d291e0176b.filesusr.com/ugd/e5d8db_81ec57806b724057855006629543cb9d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd8f.bin
b49caba57b086c736a1a8cbbab6a5dfb7098a43eabfe136f6b2d8f3e3df4cabf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD8F 5380 bytes
font_01_sfnt_off0000dfc7.bin
6d7f4c9f70c69c93521be250b9ee01c16e19aab2e7514f3c8070320516174a1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDFC7 10800 bytes
font_02_sfnt_off00010486.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10486 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.