Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d3fede987bc3cea…

MALICIOUS

PDF

99.3 KB Created: 2021-03-30 19:36:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d7c36ab5be919ea0911602c8734bb6f6 SHA-1: 7089bbaa6ab0ba869ea0bd09d7ca742b80f47fa7 SHA-256: 3d3fede987bc3cea6284abd0b9246cadef916e1de5bdbd5927fd1aa89feb3f95
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which appear to be part of a link farm designed to mimic search engine results for document downloads. The primary URL, 'https://resalured.ru/award?keyword=today+eenadu+news+paper+pdf+file+download', suggests a lure related to news papers. ClamAV and ML classifiers also identified this file as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=today+eenadu+news+paper+pdf+file+download
    • https://rewovokikulige.weebly.com/uploads/1/3/1/3/131379935/4347969.pdf
    • https://cdn.sqhk.co/xokebuzizo/dGigggz/stunt_car_challenge_impossible_car_stunt_games.pdf
    • https://cdn.sqhk.co/temokika/bVvTE4u/zemutazidovut.pdf
    • https://cdn.sqhk.co/vopovaroxamo/jgiii4u/71899414736.pdf
    • https://tadududire.weebly.com/uploads/1/3/4/6/134687045/2756786.pdf
    • https://xufolonul.weebly.com/uploads/1/3/2/6/132695880/mizasiwukinor_vibid_jaxonok_pozisebufefape.pdf
    • https://cdn.sqhk.co/gizoxemovefi/gNnhjaQ/pixel_kingdom_hack_apk.pdf
    • http://dekovag.mypressonline.com/23383198194.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3f740848-0e57-4b51-8596-564812021bec.filesusr.com/ugd/cbe17c_e8d81c2e4f8245a4853c300b03480942.pdf?index=true
    • https://s3.amazonaws.com/lulelepese/lineage_2_revolution_leveling_guide_320.pdf
    • https://ed21222e-fee3-4fab-8b52-e2ddb7bb35ab.filesusr.com/ugd/e73fea_2ff37571731c40e3bd7d0b9f142c6ebb.pdf?index=true
    • https://s3.amazonaws.com/bawalidamovidud/84237134251.pdf
    • https://s3.amazonaws.com/rizijubovapuk/69442039810.pdf
    • https://s3.amazonaws.com/pibajuwi/the_journey_of_man.pdf
    • https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_ed89dcb640a34235b4d00d26e64f67df.pdf?index=true
    • http://vebusatoro.atwebpages.com/87967004584.pdf
    • https://8964868a-aef6-4da0-9a9b-29de7c28e0c5.filesusr.com/ugd/b910ae_81704e2cb54c43caaa0c055a5a779797.pdf?index=true
    • https://s3.amazonaws.com/lumixi/grow_up_david_guided_reading_level.pdf
    • https://s3.amazonaws.com/liwafo/44210711600.pdf
    • https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_003f00b08d794aedabdab2e2ac28e8cb.pdf?index=true
    • https://s3.amazonaws.com/zaxuledo/cyber_security_information_wikipedia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001284c.bin
33f59dd3914d6a82715891cb57ecbd603281e7506a03e4899e5663cff5b24248		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1284C 2188 bytes
font_01_sfnt_off00013217.bin
1215dc5e04c224d773a080da15fc1ae5128f5dc7b3c7d505ca2bb1318076df02		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13217 5176 bytes
font_02_sfnt_off000143da.bin
2625f14d65ef97068322bcf5b1181aec80c6251c3bf4a2ea153433cad4acb10c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x143DA 11048 bytes
font_03_sfnt_off000169e5.bin
260d0bbab015a8c85cf4fe67fabc4bce5dbab7a845fa425d6c4af055876b865a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x169E5 16108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.