Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f87b01a4cb4209c…

MALICIOUS

PDF

87.9 KB Created: 2021-04-01 12:06:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ea343be72d578220058e8b3f62cdd937 SHA-1: b89d5515c7cff770707afda5dd062397d26558e9 SHA-256: 0f87b01a4cb4209cb553c0d96eb2cf9c62c5b558373507f7027ba875b036728e
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or malware distribution attempt. It contains numerous external URIs, with a primary suspicious URL being dafemum.ru, likely serving as a landing page for a phishing campaign or to download further malicious content. The document body, though partially corrupted, suggests a lure related to 'conflict resolution steps for students'. No scripts were extracted, but the presence of external links and the high ML score strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=conflict+resolution+steps+for+students
    • http://sijemogezabusa.sportsontheweb.net/rutigugeki.pdf
    • http://lixusopo.mywebcommunity.org/comptia_cysa_study_guide_exam_cs0_001.pdf
    • http://rizuxikasosokeg.22web.org/nevemamewamekosatip.pdf
    • http://gufutaca1.xyz/5261521636xi8xo.pdf
    • http://bazunujovi.scienceontheweb.net/arctocephalus_australis.pdf
    • http://mizarujil.mypressonline.com/acca_f7_syllabus_2020.pdf
    • http://betmoy57.com/skin_editor_for_minecraft_apkuk9jw.pdf
    • http://mosquito.codes/795174650139j8gs.pdf
    • http://liketime.fun/69950023272x6ere.pdf
    • http://zexaribamemavi.sportsontheweb.net/ace_personal_trainer_exam_price.pdf
    • http://sujabupinoda.scienceontheweb.net/toyota_avalon_2020_manual.pdf
    • http://opt05.ru/73745646801vt8xg.pdf
    • http://faponabon.mygamesonline.org/common_biomedical_waste_treatment_facility.pdf
    • http://gufezonasu.iblogger.org/anti_bouncing_check_law_philippines.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/7402e640-0105-43a0-b710-e1d34f5daaa1/ge_sunsmart_digital_timer_manual.pdf
    • http://konewumabujak.rf.gd/.pdf
    • http://teluroluxeterez.myartsonline.com/34464508522.pdf
    • http://futikuzita.onlinewebshop.net/muponadapozanelovadeg.pdf
    • https://uploads.strikinglycdn.com/files/6a929bc8-47cb-49a8-a946-63dd6b3a794d/100s_chart_puzzles.pdf
    • http://lobidirubegevil.epizy.com/balloon_tower_defence_battles.pdf
    • https://uploads.strikinglycdn.com/files/afabce45-278c-4cae-ad0e-d9dd9db66005/32692992158.pdf
    • https://uploads.strikinglycdn.com/files/d97c0b46-05ac-409e-9004-e83ec1fdf970/john_deere_110_tlb_parts_catalog.pdf
    • http://pesetunal.onlinewebshop.net/tokirinazuram.pdf
    • https://uploads.strikinglycdn.com/files/2dd5d661-cfe9-45d7-aee8-246d8f540489/meralexagofipunafarobil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010919.bin
9c8d8ef02a8e5d4ddde055a77fd30250b7dbf92af5a2fb8ddc143088915229e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10919 4844 bytes
font_01_sfnt_off0001199e.bin
a02341e9dc6b45493e3991ae25fc6d071731b2d7b5387994c64fbb1509ccfda1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1199E 12992 bytes
font_02_sfnt_off000143a6.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143A6 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.