Malicious PDF — malware analysis report

Static analysis result for SHA-256 4daba6e549becd90…

MALICIOUS

PDF

79.4 KB Created: 2021-03-06 05:48:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a06d1eb3f1888a14aadca168247a5a4 SHA-1: b3be2526273a784781a5a4bb922fb288582cf6dc SHA-256: 4daba6e549becd909cbe681e6c393321b698ea37f3421bfdffadcd1d18645f17
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results. The primary malicious URL identified is 'https://resalured.ru/strik?utm_term=tecsun+pl+660+manual+deutsch', which is presented in a way that suggests it is a link to a technical manual, likely to trick users into visiting a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=tecsun+pl+660+manual+deutsch
    • https://cdn.sqhk.co/burexewejam/jvgciec/gekuvalexezezujeno.pdf
    • https://cdn.sqhk.co/riwifesineji/bIjyAyx/lost_in_harmony_mod_apk_2._2._2.pdf
    • https://wivaralizufijol.weebly.com/uploads/1/3/1/4/131483386/e90316d8f.pdf
    • https://cdn.sqhk.co/gasariba/jr89hjJ/godotexokuvokutoj.pdf
    • https://cdn.sqhk.co/sowojusawepu/jiiIibB/ordinal_data_examples_in_healthcare.pdf
    • https://cdn.sqhk.co/tefulobesa/jhveRie/assistive_touch_iphone_11.pdf
    • https://kekisadubivef.weebly.com/uploads/1/3/3/9/133986731/c04df44a49038b.pdf
    • https://cdn.sqhk.co/tosuwukiwate/wzUngdy/lozijovuvakaxomefo.pdf
    • https://cdn.sqhk.co/veletafi/hVI7iby/cracker_barrel_locations_in_pennsylvania.pdf
    • https://cdn.sqhk.co/dutudovajud/dhiAcjb/beyblade_amino_apk.pdf
    • https://cdn.sqhk.co/kezulegol/fbegjgj/daily_budget_planner_excel_template.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_843c9b7336404e588b8f58253489ec75.pdf?index=true
    • https://9610c43f-1b2a-4a8a-b660-75aaf3908198.filesusr.com/ugd/286fb8_426ae25be88842ddafc1f3a304db9869.pdf?index=true
    • https://s3.amazonaws.com/gixirojozogufux/sumogituzoza.pdf
    • https://4a5660cc-52a2-48ff-9acb-4b4f1704cb6e.filesusr.com/ugd/81868d_8e1ae81921a941c2b71d426dc154b12b.pdf?index=true
    • https://s3.amazonaws.com/benuka/trigger_interview_questions_and_answers_in_sql_server.pdf
    • https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_cc77d7ac5aeb43299d089cd7f010b746.pdf?index=true
    • https://46d16763-6c5f-4e19-aa2c-3f4071fcbec2.filesusr.com/ugd/26f730_c39a4a0942824c77970afd9576396c1c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e27a.bin
cb1e6a3d3f06c6a40c83ec343e881f7cb7123b9270643675079fd48b8d108d41
pdf-font-stream PDF embedded font (sfnt) at offset 0xE27A 5184 bytes
font_01_sfnt_off0000f3e7.bin
4d8e80b79fd44776b7b2f6251fdedeec8d875e441daa494605b9556cdf71d66d
pdf-font-stream PDF embedded font (sfnt) at offset 0xF3E7 15092 bytes
font_02_sfnt_off00012214.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c
pdf-font-stream PDF embedded font (sfnt) at offset 0x12214 4324 bytes