Malicious PDF — malware analysis report

Static analysis result for SHA-256 4642bfe285e5dfad…

MALICIOUS

PDF

73.7 KB Created: 2021-05-16 05:49:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: c12e4c7c7fc955ffaa08ed2373f23186 SHA-1: e110f3054aeebc23c2c4aeffdf29e9c7886d85cf SHA-256: 4642bfe285e5dfadeadfc7cab1806b767708bc20c5e2af3cac16ce16b101f2e9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent link pointing to 'https://druttle.ru/strik?utm_term=how+to+service+harley+davidson+motorcycle', suggesting a phishing or redirection attempt. The presence of a PDF link farm heuristic further supports the idea that the document is designed to distribute traffic to other malicious or spammy sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=how+to+service+harley+davidson+motorcycle PDF link annotation
    • http://help-nanny.site/national_geographic_magazine_contributor_guidelinesnafpk.pdfIn PDF document text
    • https://gepumisi.weebly.com/uploads/1/3/4/5/134517510/2282986.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490961/normal_5fcdb26024c71.pdfIn PDF document text
    • http://sibuvre.com/25802674731mbzh9.pdfIn PDF document text
    • http://coolvdomaion.online/what_are_examples_of_suffix_nessrwal5.pdfIn PDF document text
    • http://natikolom.site/677378746318z7j5.pdfIn PDF document text
    • http://wumofuzusagumo.22web.org/the_beautiful_word_devotional.pdfIn PDF document text
    • http://givavipuj.iblogger.org/wevarumozenizug.pdfIn PDF document text
    • https://rujavuxubigiwak.weebly.com/uploads/1/3/4/3/134331492/dorukepadosop.pdfIn PDF document text
    • http://spainwow.pro/what_happens_when_your_kindle_fire_wont_turn_onl2rgq.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374175/normal_604d7f2358c58.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414336/normal_5ff7618367a90.pdfIn PDF document text
    • https://xamubamujizej.weebly.com/uploads/1/3/1/4/131483378/zigewinumazetoveg.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fasomusogapovi/scout_badges_on_uniform_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/suzixegazunow/manpower_approach_to_educational_planning.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/how_to_bypass_quota_google_drive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48240e8d-8247-4f0c-be38-9bfcc34ae00c/xolupesubowowigaroxanisel.pdfIn PDF document text
    • https://s3.amazonaws.com/fusidejebi/bounded_sequence.pdfIn PDF document text
    • https://s3.amazonaws.com/napisakaluja/adobe_photoshop_touch_for_android_9._0.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8647c76d-b672-4c20-94aa-2fd714fb9d7e/terapia_cognitivo_conductual_para_nios_con_tea.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f870155-dfbb-45ad-aff2-67fe58fba45f/2009_ap_language_and_composition_free_response.pdfIn PDF document text
    • http://duvujod.rf.gd/lazabev.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3E1 5392 bytes
SHA-256: 63f32949b724676a3f6318ceed9e9278194edcc32cc15b5a1bcec4d7c8cb4afc
font_01_sfnt_off0000f629.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF629 10256 bytes
SHA-256: 454f306ea7c00d1b7b7d7eab7d7d0bfefa9e27648a50f56521da9a77c3d20eae

Open this report in the interactive analyzer, or submit your own file for analysis.