Malicious PDF — malware analysis report

Static analysis result for SHA-256 3df6bbd3550fed16…

MALICIOUS

PDF

78.2 KB Created: 2021-03-25 06:47:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c8102cabd390f9a7293df3e956506105 SHA-1: a02c44a5f6ce8fa32aa6c04c5ada9305c7ce5cea SHA-256: 3df6bbd3550fed16e11be0a1c97074bc47b32325d6ef391ad30ed452c0a4095d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and a machine learning classifier, indicating a high likelihood of malicious intent. The heuristics reveal it contains a large number of external links, suggesting it is part of a link farm designed to distribute malicious content or phish for information. The primary lure appears to be a free download for 'My Friend Dahmer', directing users to a URL that likely serves as a gateway to further malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=my+friend+dahmer+pdf+free+download
    • https://lufalejovi.weebly.com/uploads/1/3/1/3/131380058/1475461.pdf
    • http://tatuxuvoziparu.mywebcommunity.org/pride_and_prejudice_atlanta_movie_online_free.pdf
    • https://mubatizusilaboj.weebly.com/uploads/1/3/4/4/134475350/5547833.pdf
    • https://dotanivim.weebly.com/uploads/1/3/4/7/134705276/9802268.pdf
    • https://lorotemorotur.weebly.com/uploads/1/3/4/6/134649447/9942670.pdf
    • https://zifakilis.weebly.com/uploads/1/3/2/3/132302733/bavomipawatike_tegegilutimevi_govifafedu.pdf
    • https://cdn.sqhk.co/jivapereb/O6hixie/modopuketawejazer.pdf
    • http://xajavawinereko.mywebcommunity.org/86389654900.pdf
    • http://bumosid.getenjoyment.net/72441794599.pdf
    • https://rilavowa.weebly.com/uploads/1/3/2/7/132740415/f876a567.pdf
    • https://cdn.sqhk.co/bufudoraxala/ugjnTPD/teddy_roosevelt_national_park_south_unit.pdf
    • https://dixapixukezawe.weebly.com/uploads/1/3/5/3/135388261/7ca10c0b.pdf
    • https://ladetizor.weebly.com/uploads/1/3/4/7/134731735/3547387.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e510c2d5-567e-4a96-89ff-abc18316baf7.filesusr.com/ugd/8a9bcc_0a3beaab627144f8897b7673a0b09e39.pdf?index=true
    • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_77e36034dfb64f7790098b905d91be0f.pdf?index=true
    • https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_be6e4b4fabcd4a55b3314fbe0a71f0d3.pdf?index=true
    • https://f8ba888e-8f71-4fde-8303-550399648f4e.filesusr.com/ugd/17ce20_acaf2dc116774d148f73fbfc57a40a6e.pdf?index=true
    • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_e38798f656074a33bf15a4c3a470e8ee.pdf?index=true
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_2a65e9931e01410d9807b33089280ff5.pdf?index=true
    • https://9df6e0af-a028-4e88-91ba-61a1b37318d5.filesusr.com/ugd/7c1f05_4a5d9f7777dd4625bd2fa13779d87740.pdf?index=true
    • http://sawesupunozigiv.atwebpages.com/26168945964.pdf
    • https://510adc33-753b-44c0-977e-8d34da8fcdd4.filesusr.com/ugd/5f4192_779f4c259597472bab401765d670f0bf.pdf?index=true
    • https://cc4f1b1a-08c7-467e-bb5a-e3073ad8caf1.filesusr.com/ugd/ffc175_16d517c8a21248feb1b7d6c0ddfc7c8f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f315.bin
39b9c3a7f13bce640ea95663020548a10d18b5d5d7d66ac7ddf21098a17c2574		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF315 5304 bytes
font_01_sfnt_off00010517.bin
d45ddebbe048c49641584d8f49e22266319c20689de784b229f9857a7089ee6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10517 11220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.