Malicious PDF — malware analysis report

Static analysis result for SHA-256 37ce25166c617a21…

MALICIOUS

PDF

77.6 KB Created: 2021-03-08 13:22:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f2d47ff079a150c192135492bba7466a SHA-1: d06734036be55a4f384eaa086e97cb8d78ece82a SHA-256: 37ce25166c617a21f14c5a90dfffb888804d13fcca86fec07b99cefb2b3f47c3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a mass of external links, many of which are likely malicious, as indicated by the 'PDF_SEO_LINK_FARM' and 'CLAMAV_DETECTION' heuristics. The primary malicious URL identified is 'https://dafemum.ru/strik?utm_term=the+bible+for+dummies+review'. While no scripts were explicitly extracted, the PDF structure and link farm suggest it's designed to redirect users to malicious sites, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=the+bible+for+dummies+review
    • https://cdn.sqhk.co/sodelaranu/iiuibig/zujezexukaparazolupevuba.pdf
    • http://zibodotuf.mygamesonline.org/25789310735.pdf
    • https://cdn-cms.f-static.net/uploads/4389568/normal_603ff9bd9b0c4.pdf
    • https://cdn.sqhk.co/vilubofi/wtjeSii/funny_parenting_advice_for_first_time_parents.pdf
    • http://kamikofonem.mygamesonline.org/spelljammer_ships_5e.pdf
    • https://static.s123-cdn-static.com/uploads/4424376/normal_5fe5dd9219647.pdf
    • https://cdn-cms.f-static.net/uploads/4446642/normal_6038b4fe0498e.pdf
    • https://cdn.sqhk.co/kubepugemaki/haKNAVr/78523709939.pdf
    • https://cdn.sqhk.co/kesavaki/jpuge91/fimagujewe.pdf
    • https://cdn.sqhk.co/rujiwujik/cjfppTc/among_us_phone_wallpaper_gif.pdf
    • https://cdn.sqhk.co/liweruruzed/hegfgkG/93568072570.pdf
    • http://kaxiwemusemoj.mypressonline.com/fiduzexaresaxego.pdf
    • https://cdn.sqhk.co/pazaxefuma/hfxzhet/hill_climb_racing_games_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0ef2f354-78a3-4528-990c-72f69c86fc6a.filesusr.com/ugd/6a0da6_e638fb98fff4409f931061e580f19608.pdf?index=true
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_19b70ebd772e4a43a2c90e287c209935.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4003192b-9ed0-4226-a9b2-a4ebd7d50d30/35362235459.pdf
    • https://bc732cde-fb09-4fee-8ab5-c82a45a1131b.filesusr.com/ugd/2ac701_e21582a346484f349ff832945ecf7534.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0867d85a-95c9-41fb-b3e6-f7483a94bd4b/vidaketikimukar.pdf
    • https://198d5876-2e36-4a54-a59d-b4c1060b65be.filesusr.com/ugd/4733ca_d991a1a847a2424ba3ce0149589789d0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bdb1fd0c-cfed-4867-8a2a-f5230ac3505e/86331606469.pdf
    • https://uploads.strikinglycdn.com/files/9abf8e66-83a1-40ff-837a-66e027c32213/ruguliwizibomanuzal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f206.bin
93713f6b342b859ffadfd2a6d5d2aedd67afef6e5f83bff16eac4da7481053d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF206 5180 bytes
font_01_sfnt_off00010388.bin
5a6a73d2401332f28a5cd48150c23e4ebbc5dd1d5f6d8a38967eaa87dc944cd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10388 11104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.