Malicious PDF — malware analysis report

Static analysis result for SHA-256 439cc05b940b6c28…

MALICIOUS

PDF

88.1 KB Created: 2021-03-17 01:06:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0bb453fd8c0c7f3836508fc4b5c35e07 SHA-1: 3a8520147958b2a884aa54e9909142bc5c8be72f SHA-256: 439cc05b940b6c28f9f37abda95f40187b04a67299280201c538f3ff8c846ccd
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF_SEO_LINK_FARM'. The primary malicious URL, 'https://dafemum.ru/strik?utm_term=foodsaver+v3825+repair', suggests a phishing or malware distribution attempt disguised as product repair information. ClamAV detection and ML classification further support its malicious nature, indicating it's likely a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=foodsaver+v3825+repair
    • https://cdn-cms.f-static.net/uploads/4482854/normal_60506d4fb6614.pdf
    • http://study-english-04.space/bumumijlr7r.pdf
    • http://badgesverified.com/623828493148xyeg.pdf
    • http://petrol-v-pol-price.site/ipc_connection_error_connection_refusedm3jfn.pdf
    • http://beautysss.site/barron_s_spanish_grammarg0kn6.pdf
    • http://lovewaits.ru/the_tipping_point_summary_essay36uki.pdf
    • https://cdn-cms.f-static.net/uploads/4367301/normal_603621577cc38.pdf
    • https://static.s123-cdn-static.com/uploads/4416666/normal_5ff2e60c62389.pdf
    • http://mmamba.ru/zufozuporanijikopy52rz.pdf
    • https://cdn-cms.f-static.net/uploads/4379602/normal_605137a85fdfb.pdf
    • https://static.s123-cdn-static.com/uploads/4369487/normal_6007feaf9ccf7.pdf
    • http://goodsun.space/vpn_for_iphone_onlinegjg1q.pdf
    • http://akfb.online/8991471605208vp6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://348ddb29-83e1-4812-94a1-743b72ef9b42.filesusr.com/ugd/23b571_96e5ab9e9e3b4c3fa590d4f7f183582f.pdf?index=true
    • https://s3.amazonaws.com/widiku/internal_control_framework_template.pdf
    • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_61215be7e46d4e2c8ee4b247a76e679f.pdf?index=true
    • https://1639490a-f715-481e-9fb1-af38d332269b.filesusr.com/ugd/a59130_07d48ac1a6094b94a2205059ab013182.pdf?index=true
    • https://s3.amazonaws.com/xijuxosisomuna/english_spanish_legal_dictionary_online.pdf
    • https://e41bb7a9-a35b-4578-ac27-1eab720d379a.filesusr.com/ugd/8912ce_6fd68ea372254744b2c51f7cde894d6e.pdf?index=true
    • https://9c43cb74-45e3-47de-9527-fda2e8336169.filesusr.com/ugd/af0aa9_d08744c485cf44e38e479f174ffd20dc.pdf?index=true
    • https://377d1c6c-8747-407e-9a0d-bb8234813250.filesusr.com/ugd/f0b1fd_7e8802e339894c26a26dc1915437b601.pdf?index=true
    • https://46ebecaa-9490-439b-bba6-ee77f1a6ca93.filesusr.com/ugd/cee8a1_fd5cc1cb0e9a434b8ba10f9c39c45b29.pdf?index=true
    • https://5704a788-058b-4bd0-b855-5c90d1fb7469.filesusr.com/ugd/bf07b1_c880cb525bed4b5aaffffcddbcdf2de9.pdf?index=true
    • https://64db0a9d-d2b7-4705-beb9-75cca7f1d068.filesusr.com/ugd/4c6241_a0482cfeb28342a08fde9e890abb6186.pdf?index=true
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_05805bf382f544a0bab5dc8ea6b999ac.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d8d.bin
1f98b8d4ab5aa5434617e8d6f924cf42882b7f29afc46e34119f109340c17cb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D8D 5152 bytes
font_01_sfnt_off00011f27.bin
c3437212d100d8a3ab2e05b696c12c101190a1a1dcec087e48c470f549f74714		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F27 10580 bytes
font_02_sfnt_off0001435a.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1435A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.