Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dd1a248c80ba1cc…

MALICIOUS

PDF

78.7 KB Created: 2021-03-16 08:02:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7d464a7d9e6b9bd30d002a7f9817210c SHA-1: be233a5287020314b25e44ee8aa226335658bf71 SHA-256: 2dd1a248c80ba1cc83b93ebef2e8256c9510dbac1dc3e2b613422eb4c94f2f26
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a link farm and an embedded URL pointing to 'dafemum.ru', suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate maliciousness. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a social engineering attack designed to redirect users to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=post+office+size+guide+template
    • https://cdn.sqhk.co/sixepatexup/ihidNm7/monkey_boxing_mod_apk_unlock_all.pdf
    • http://dalifajebuxog.scienceontheweb.net/bemoza.pdf
    • https://cdn.sqhk.co/gujuvizaja/geiaegh/najojexusepixegudemikaxiv.pdf
    • https://cdn.sqhk.co/sinupupuzaxa/a0jgJhb/mizuzamekumafunaw.pdf
    • https://cdn.sqhk.co/nazujovo/Rbhhdib/cancer_de_tiroides_diagnostico_y_tratamiento.pdf
    • http://sizerasadaxer.mywebcommunity.org/baxutoweka.pdf
    • https://cdn.sqhk.co/tifobebe/shbkjju/gaperumarifiruna.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/80a366a8-5e22-4019-b4e7-c72821565488/are_portable_oil_filled_heaters_efficient.pdf
    • https://uploads.strikinglycdn.com/files/9b64af29-e3e6-49a8-b4dd-ebef492f8d99/standard_deviation_worksheet_tes.pdf
    • https://uploads.strikinglycdn.com/files/b8108c51-b613-4128-bffc-c4acd020263e/shark_apex_powered_lift_away_vacuum_cleaner.pdf
    • https://uploads.strikinglycdn.com/files/4f8bb46a-1630-47af-bec4-d7e5b5995b3a/esa_essential_facts_about_the_computer_and_video_game_industry.pdf
    • https://uploads.strikinglycdn.com/files/d8572fe4-9e80-4bc4-82b3-a0bb8362f184/nugoxu.pdf
    • http://widifusi.myartsonline.com/ews_10_reservation_form.pdf
    • https://uploads.strikinglycdn.com/files/f87e88c0-04ac-47b4-950d-52cc94b19216/61450402751.pdf
    • https://uploads.strikinglycdn.com/files/756ccc84-aa50-4021-b8f7-4368ed0280bf/670_vs_690_roomba.pdf
    • http://pivimufe.atwebpages.com/raja_yoga_book_in_gujarati.pdf
    • http://rorazizaxaf.atwebpages.com/6165870844.pdf
    • https://uploads.strikinglycdn.com/files/063a3050-c897-4e42-a1ff-fd8f9fcc46a2/39669158256.pdf
    • https://be1d055c-b83b-422e-9e68-1bf13cef350c.filesusr.com/ugd/5b1e3c_6e822fcf901447cab3fb18692f3396be.pdf?index=true
    • https://4a39c6c9-989b-4d11-b2d8-cc0becc7f193.filesusr.com/ugd/ef0078_3817e07dbcb942b8869c5aad0a172afb.pdf?index=true
    • https://c4a5d104-04f9-44e6-b03f-1f5edac3680f.filesusr.com/ugd/f23921_2f1634e74c784612a0039ad37d393f64.pdf?index=true
    • https://c183b790-cb34-49aa-848e-1a9f2b14dda3.filesusr.com/ugd/d8966e_0bf88fd0b8c543e793de2874f862aef5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6c70426e-03aa-4bfb-b9e1-6cc14ea1d0b0/29127184377.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f59a.bin
5b855b69f247ea964dae05ce61c1c273df4dd64728fd28a118e930d82ddf548b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF59A 5432 bytes
font_01_sfnt_off00010810.bin
fa33b1058c54cba8aae376c48f9c28772195c32ed3401ef94d19972e63e8da6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10810 10832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.