Malicious PDF — malware analysis report

Static analysis result for SHA-256 1229376da7ab71ee…

MALICIOUS

PDF

84.9 KB Created: 2021-03-17 11:37:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2c4e447f85262b850d469e34afba704a SHA-1: 5598522a0cfa8200ae1db423b90236a06fd1c6ff SHA-256: 1229376da7ab71ee57423404acdbf2f379f30bb707b9a1d3b9c086659fad4079
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as 'Pdf.Phishing.Trojan' and an ML classifier indicated a high probability of maliciousness. It contains a large number of embedded external links, with a critical heuristic identifying it as a PDF link farm. The primary malicious URLs identified are dafemum.ru and fekevoipimibun.sportsontheweb.net, suggesting a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=whatsapp+apk+drawer
    • http://fekevopimibun.sportsontheweb.net/motorcycle_for_sale_near_me_cheap.pdf
    • http://bofesota.66ghz.com/wodevirimemametodaperix.pdf
    • http://pixizosusonaxij.sportsontheweb.net/39579645874.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2b121178-7160-4894-8187-8349159278f5/manual_de_supervivencia_urbana_fernando_aguirre.pdf
    • https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_f63ce6711a984a7b8394cc92e954b16e.pdf?index=true
    • http://gulagopafed.onlinewebshop.net/56270816311.pdf
    • https://uploads.strikinglycdn.com/files/6bc02804-548e-417e-9b2b-9dde508a03a5/setimeziwodopoganasiwame.pdf
    • https://uploads.strikinglycdn.com/files/fa3d34bf-5e20-46e5-81b9-ba2bf0e5433a/48784470498.pdf
    • https://0e733887-fd72-4d21-8b10-0a39cafbc931.filesusr.com/ugd/1e4d10_06393618e8214c3db4ba55f21de1ad3e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4803a80a-5d69-4f5f-b89f-5c3535ab44c5/sovigasufurerubopur.pdf
    • http://fovawipemezipu.myartsonline.com/how_much_is_a_2020_ford_mustang_convertible.pdf
    • https://uploads.strikinglycdn.com/files/ebdbb1cb-6499-4d41-8eaa-2fd4ea242b2c/harbor_breeze_ceiling_fan_light_bulb.pdf
    • https://uploads.strikinglycdn.com/files/84fdd313-8ca2-4299-b7d0-177fb236de58/48738395914.pdf
    • https://uploads.strikinglycdn.com/files/140b7a1f-7a86-495c-8a4b-db9eb56ea221/jakosej.pdf
    • https://fb413987-6e77-4bf1-aaa6-e97eb550fbee.filesusr.com/ugd/108936_8b44c463894b4f7aa8aed15eb40fb7bb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d94fac33-2473-408e-a8c3-b23852bdc7fb/pojamanidemirewizivobixab.pdf
    • http://litorow.myartsonline.com/mtv_the_challenge_inferno_2_episode_3.pdf
    • http://wugujub.onlinewebshop.net/tokyo_ghoul_re_call_to_exist_ps4_theme.pdf
    • https://uploads.strikinglycdn.com/files/78d2151e-15b9-4ee8-986a-34345665f98d/the_500_greatest_songs_of_all_time_spotify.pdf
    • http://suredutika.rf.gd/bahubali_cinema_telugu_lo_ing.pdf
    • http://vawanumezal.onlinewebshop.net/56862726444.pdf
    • https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_ff0b34060a6849958bd632bb328b8d19.pdf?index=true
    • http://lojofoverom.epizy.com/pokoxitigobaraxub.pdf
    • https://502f924d-676a-41b3-8220-87c01882f600.filesusr.com/ugd/5a20bb_7f0c7dce931049e488b239cf7600ac09.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a4e6b29f-55f7-4e7c-b7be-8ebfe5576477/sony_ht-ct370_remote.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b46.bin
cfa1cfc3f3f40cd2026c9849c16ac0e8cdfe9067f4518c31ef14775eaa037f8a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B46 5184 bytes
font_01_sfnt_off00011cf8.bin
ed4945d321acc32f946d255b0df1d8e326a3be7f21413f2245caa00644a4732d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CF8 12192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.