Malicious PDF — malware analysis report

Static analysis result for SHA-256 10c8e5bed0a87cc2…

MALICIOUS

PDF

67.5 KB Created: 2021-03-11 11:40:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 876a7ad3fd3803e6817e8d1bf091fd7e SHA-1: dbb6039b0c4fff5200bd25eaa520bd0fbff3f018 SHA-256: 10c8e5bed0a87cc29d534fbb83640bd9bc7fbc72b5245a0470cab464fb3cba14
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with the primary one being dafemum.ru, which is presented as a search result. The document body, though heavily obfuscated, appears to be a lure related to 'math anxiety'. No scripts were extracted, but the presence of multiple external links suggests an attempt to redirect the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=what+is+math+anxiety+in+the+philippines PDF link annotation
    • http://olx-delivery.cc/sekunamikeojo4l.pdfIn PDF document text
    • http://wwbook.org/bupekafe1zdt4.pdfIn PDF document text
    • http://shtangennstutkupitseychas.xyz/fumejidafozogigiditibup8ib1y.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376127/normal_5ffb13a352e35.pdfIn PDF document text
    • http://dududuw.mypressonline.com/stihl_blower_bg86c_parts_list.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390323/normal_6022ea4ab5686.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489050/normal_6019ab25e409b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390659/normal_60220ea167aaa.pdfIn PDF document text
    • http://lazadacostumercenter.com/hollywood_reporter_most_trusted_news_anchorsrxvsl.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kewakuko/24350862745.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df0dc2df-f22a-4a32-8647-298cad9a63cf/34764766999.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40050cd8-3ca1-4cb4-82d9-615bc0f02d63/mimaxokubopowenetate.pdfIn PDF document text
    • https://4228e3e8-6e56-436b-9c2a-5710a6c3a216.filesusr.com/ugd/e32dc8_e1d8ca1180b94469aac11c57c7c1ddac.pdf?index=trueIn PDF document text
    • https://010f2e21-25ca-4560-806d-08cbbb7c7db1.filesusr.com/ugd/74a852_b5f6fbb796054c81aeefee5192bd5a73.pdf?index=trueIn PDF document text
    • https://712e085e-8422-4094-ae2e-709d430f1fc9.filesusr.com/ugd/bf8edb_6518c4a443064720be13865a25220ce4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/fizodovubotovawa.pdfIn PDF document text
    • http://bukezodebas.onlinewebshop.net/vikovewatikala.pdfIn PDF document text
    • https://s3.amazonaws.com/lekelepowo/combustion_analysis_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be67965c-bc8e-43d6-abae-71ccdeb812fc/39054250835.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD1D 5148 bytes
SHA-256: ae108ed4d96e3a62b6e0a7cf32ecba95cbaaa55cc0a1c2fc859f3dee254e499f
font_01_sfnt_off0000de92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE92 10008 bytes
SHA-256: fffa5560c1dc6327354fdb956dffce0d678137de188a5300c5cba535eee140cf

Open this report in the interactive analyzer, or submit your own file for analysis.