Malicious PDF — malware analysis report

Static analysis result for SHA-256 44c5dcda8e8a66b8…

MALICIOUS

PDF

66.8 KB Created: 2021-03-18 00:22:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e376a7c7f51efbf947bf4d5014240e40 SHA-1: 246f1cd421e1f145efa21aab171295bee4ad88fb SHA-256: 44c5dcda8e8a66b8c6c1775ab814c29b4303110cad9a4e47199ee3c24cd6fae1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'mass external PDF link farm' pointing to various PDF files. The primary URL, https://druttle.ru/award?keyword=fourth+grade+master+spelling+list+pdf, suggests a lure related to educational content to disguise malicious intent. ClamAV detection and ML classification further support its malicious nature, indicating it's likely a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9937

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=fourth+grade+master+spelling+list+pdf
    • https://static.s123-cdn-static.com/uploads/4380858/normal_5fedd316748e6.pdf
    • http://basagutidabe.sportsontheweb.net/the_ascents_of_james.pdf
    • https://rojilijeliw.weebly.com/uploads/1/3/1/4/131409822/2f643a.pdf
    • https://static.s123-cdn-static.com/uploads/4473053/normal_5ff26017d84fe.pdf
    • https://nometiru.weebly.com/uploads/1/3/4/3/134379396/1686ed2f74.pdf
    • https://static.s123-cdn-static.com/uploads/4500447/normal_5fca4284db91b.pdf
    • http://goxamid.mypressonline.com/wazidemoxoguji.pdf
    • https://cdn-cms.f-static.net/uploads/4379970/normal_60399b80dcd87.pdf
    • https://static.s123-cdn-static.com/uploads/4388040/normal_5ff17f8be94f2.pdf
    • https://static.s123-cdn-static.com/uploads/4406168/normal_6008ed604ec84.pdf
    • https://static.s123-cdn-static.com/uploads/4383132/normal_5fc908ee7726b.pdf
    • http://sijemogezabusa.sportsontheweb.net/laxemoxeje.pdf
    • https://static.s123-cdn-static.com/uploads/4485821/normal_5fcd728336267.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/julaxel/dd_5e_madness_table.pdf
    • https://s3.amazonaws.com/zidosozawok/what_is_the_best_selling_beer_in_the_uk.pdf
    • https://s3.amazonaws.com/dumupa/progressive_disciplinary_action_template.pdf
    • https://s3.amazonaws.com/tirimofufemukat/29809343840.pdf
    • https://s3.amazonaws.com/xakapudakadu/22080520476.pdf
    • https://s3.amazonaws.com/gedimuta/flask_template_inheritance_example.pdf
    • https://s3.amazonaws.com/bifadiwuwileji/cablevision_channel_guide_norwalk_ct.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8b3.bin
5cd079125b38b5f84c4749354d1d7dccf6fbb731214fea6a50d03550ad4d45f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B3 5412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.