Malicious PDF — malware analysis report

Static analysis result for SHA-256 2df3fb5ca08b2d4c…

MALICIOUS

PDF

75.7 KB Created: 2021-05-03 23:21:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 676fe4e3f4d1634ea6e931f0d6437e47 SHA-1: 56b735017876e6cf393fc234e86972a19a12a211 SHA-256: 2df3fb5ca08b2d4cd94eabd86de56fbd7993d4025fad6b6bc1ae3315cca31820
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting a link farm or SEO abuse tactic. The primary URL, 'https://resalured.ru/strik?utm_term=how+to+verify+itil+foundation+certification', appears to be a lure for users searching for ITIL certification verification. While no scripts were directly extracted, the PDF structure and the presence of external links are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+verify+itil+foundation+certification
    • https://static.s123-cdn-static.com/uploads/4393754/normal_5ffd533e49c32.pdf
    • http://about-central.com/94318034788ly5l.pdf
    • https://cdn-cms.f-static.net/uploads/4443576/normal_6054689f25389.pdf
    • https://xasukibumit.weebly.com/uploads/1/3/4/7/134749231/narenu-jovekoraz-menuki-rafab.pdf
    • https://rajikaluniker.weebly.com/uploads/1/3/1/3/131383998/1188763.pdf
    • https://cdn-cms.f-static.net/uploads/4413239/normal_5fe68ff84f2ef.pdf
    • http://centerverifybadge.com/724863974751tx7y.pdf
    • https://static.s123-cdn-static.com/uploads/4384459/normal_5ffa8225b5883.pdf
    • https://zegarujavo.weebly.com/uploads/1/3/4/6/134667802/maludukora-tagimozav-makiwokenizum-dokubulagumabaz.pdf
    • https://cdn-cms.f-static.net/uploads/4477181/normal_605dd35f576cc.pdf
    • http://homearfes.com/578203080783dxp1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/861868cb-bbd4-4a64-b79f-539e5a1c822f/defavonajogagulisigovexe.pdf
    • https://71b34470-2e60-4936-811b-9f14cb47e32b.filesusr.com/ugd/1dbbf0_73a993f66adc4e089cf46bb2eac441d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b1ea742a-bf68-48fb-bd5a-ce9e7372e893/sabozuki.pdf
    • https://uploads.strikinglycdn.com/files/98c0dcba-6fdf-4863-9077-4c47946f7241/92241101471.pdf
    • https://8533cbf3-c0d6-400c-bdf8-8ca38cf0242b.filesusr.com/ugd/135178_0c22a177ec814f3ea2800e1ae8de91d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/da34f7b8-0831-4b62-a996-ec324aafe679/giteme.pdf
    • https://uploads.strikinglycdn.com/files/a39daeba-157f-48ac-9f87-8fe8f68d8ac2/2989115647.pdf
    • https://uploads.strikinglycdn.com/files/8d7b9fa6-81f2-496f-8176-fd86d8dcdd97/what_is_the_theme_of_a_beautiful_mind.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e980.bin
f15d92519c1d1dd304b85d0d17c1a18c345c472a797f70eabae8fe8141d5f011		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE980 5052 bytes
font_01_sfnt_off0000fad5.bin
855a58eba5e7e481703dab34b99acbeef4a34c63f444f0810844264f9d177600		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAD5 11484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.