Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a403fd0e0828132…

MALICIOUS

PDF

79.0 KB Created: 2021-03-25 13:38:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50d852583ce51a69d1749cf89d6ffc09 SHA-1: 7a7a1ef1a10cfee98d9ad898c7242f92a7170f6b SHA-256: 2a403fd0e0828132caa6ce8c72470f2abf168cd23a6aaf17f8db75297b37bc36
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains references to 'grab apk uptodown' and application metadata, suggesting a lure for potentially malicious downloads. The presence of numerous external URIs, including one pointing to 'dafemum.ru', indicates an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=grab+apk+uptodown
    • http://pegejoruvufiron.sportsontheweb.net/kikujumaradexilen.pdf
    • https://static.s123-cdn-static.com/uploads/4503987/normal_600139e90117a.pdf
    • http://tevajevidiwa.22web.org/good_luck_in_spanish_slang.pdf
    • http://sipipewawezizuf.getenjoyment.net/zulumizemem.pdf
    • http://femesugubu.iblogger.org/saxijuvizipubizuz.pdf
    • https://cdn-cms.f-static.net/uploads/4454995/normal_600bd65a4d44f.pdf
    • https://cdn-cms.f-static.net/uploads/4485935/normal_602dfefdc2219.pdf
    • https://cdn-cms.f-static.net/uploads/4469824/normal_60446b8812615.pdf
    • http://mafonofolifeda.22web.org/kuralupub.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/22540528-7281-4662-a341-81bdfb89ac6b/the_game_changers_diet_recipes.pdf
    • https://s3.amazonaws.com/kukazowox/david_gibbs_iii_wikipedia.pdf
    • http://minegavanifur.rf.gd/cheese_in_the_trap_ep_10.pdf
    • https://a97cc435-ef8e-4ffb-8544-4b9c0bda5a6e.filesusr.com/ugd/7ab440_549904962dd94c7ea17cb43a3a9be974.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c33a4ebb-25a0-450b-a403-3ce4241cf795/vemararorolusuf.pdf
    • https://s3.amazonaws.com/kozibowisenatu/disney_coloring_sheet_printable.pdf
    • https://uploads.strikinglycdn.com/files/48dca611-9a78-4ed1-ac4b-7445fdb5c8cf/45858101218.pdf
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_f97e52d04198474ea24e5f92f287cfe0.pdf?index=true
    • https://404c0e03-56c4-4888-bb84-d9d32a71a3e4.filesusr.com/ugd/100e2e_9f187cc500eb4eb5b4341b6f0a99463e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ad3e920e-8ede-4054-8de5-47e67294cc8b/kafodabuxufufomi.pdf
    • https://s3.amazonaws.com/jivagajamav/3439300517.pdf
    • https://uploads.strikinglycdn.com/files/6ddbddb6-0e72-4dbd-b6a5-a664d846a999/ejemplo_de_resumen_de_un_trabajo_monografico.pdf
    • https://s3.amazonaws.com/tazopaju/twitter_photo_er_pc.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e021.bin
8873a6f920fd7e53b3cf01a02d119c4b61ace339069d18ca8b8e4a73711a7763		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE021 3596 bytes
font_01_sfnt_off0000ed02.bin
a1a4aab43147ee298e8fff556a468906c665050cb3e9a9e2db584d6ac1b5e5bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED02 4788 bytes
font_02_sfnt_off0000fd5d.bin
3bb31608cff20866df1e5e38586dc69d0eca88bd1c6a29ec39eed274436ac9da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD5D 10184 bytes
font_03_sfnt_off0001203e.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1203E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.