Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a5ce542b902b44a…

MALICIOUS

PDF

76.4 KB Created: 2021-03-22 12:20:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d894ea896ca755b0e4f85e33b146f1a2 SHA-1: d7091d9dc4b2b0bc8eef9e7f9e79c643849cc637 SHA-256: 2a5ce542b902b44a471e77303c2b6329866931691a77b2b7205c3c3a6a52b882
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO link farms and potentially phishing or malware distribution. The primary malicious URL, https://dafemum.ru/strik, is suspicious and likely leads to a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=great+american+songbook+sheet+music+free+download
    • https://cdn.sqhk.co/vixukose/j2LvibL/25876013511.pdf
    • https://vamemaxodoj.weebly.com/uploads/1/3/1/4/131437173/bunogipumiko.pdf
    • https://cdn.sqhk.co/tumowara/eiaIha7/lexile_to_guided_reading_level_chart.pdf
    • https://jijobowuzum.weebly.com/uploads/1/3/4/5/134590228/jimak.pdf
    • https://cdn.sqhk.co/lopokevofoti/bhejhje/52174601704.pdf
    • https://jikevisanudopud.weebly.com/uploads/1/3/4/0/134017539/109807a03ea5.pdf
    • https://cdn.sqhk.co/nolugavetiri/WhhwJig/somidemotawipepiboxuxegi.pdf
    • https://cdn.sqhk.co/lilapanorup/udibhc5/kuzedotapenobagekekoxipi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/574f9f01-248d-41e3-8d81-ce6206c5cde2/char-broil_tru_infrared_patio_bistro_180_electric_grill.pdf
    • https://s3.amazonaws.com/sowewazulejewi/collecting_ant_specimens_reading_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/c4dcabe1-df65-4b1f-86c2-0d4a9f131a8a/82728801234.pdf
    • https://s3.amazonaws.com/navoburarovada/what_are_the_characteristics_of_a_good_teacher.pdf
    • https://uploads.strikinglycdn.com/files/341e9434-a5dd-41be-8899-32e9086e93eb/briggs_and_stratton_675_series_carburetor_cleaning.pdf
    • https://s3.amazonaws.com/dewazewokib/fundamentals_of_database_management_systems_2nd_edition.pdf
    • https://s3.amazonaws.com/xidazeze/kipulejonijaguxepegivozu.pdf
    • https://s3.amazonaws.com/ronatiduzoxij/35692276639.pdf
    • https://s3.amazonaws.com/somamere/report_adjusted_r_squared_or_r_squared.pdf
    • https://s3.amazonaws.com/xifabilejilab/91149107115.pdf
    • https://s3.amazonaws.com/pewibim/crusaders_quest_challenge_3_guide.pdf
    • https://uploads.strikinglycdn.com/files/97999a7a-6d1f-4ed6-bdd0-08f5fe9cf33c/how_to_service_a_dyson_dc25.pdf
    • https://s3.amazonaws.com/fizufapu/surviving_the_dust_bowl_video_answers.pdf
    • https://s3.amazonaws.com/babuxufarizuxur/bookkeeping_general_ledger_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eceb.bin
e8f7795c111b990e512ea7117c88dbd8e444cc716f1c642a3e0b3c90092edfd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECEB 5760 bytes
font_01_sfnt_off0001006d.bin
a818543685504a8d69c1e8c90b12487122f8efdf06d81587b4dbfff29fed9502		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1006D 10400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.