Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f9edcdc698b4bf7…

MALICIOUS

PDF

82.3 KB Created: 2021-03-05 23:25:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 563cf06a1351b08354d4d0211554f0ef SHA-1: 4f6699fbee8e154bedfd7d9d3f30c3025845be58 SHA-256: 4f9edcdc698b4bf7e865d8f8b0f358569c50fc04d4a01d95321ed948edc975fe
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to disposable hosting, indicating a link farm or redirection scheme. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware delivery. The embedded URL 'https://druttle.ru/strik?utm_term=pressure+washer+pump+for+honda+gx270' is a primary indicator of a malicious redirection or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=pressure+washer+pump+for+honda+gx270 PDF link annotation
    • http://zisuroto.mygamesonline.org/how_many_ounces_is_dunkin_donuts_large_coffee.pdfIn PDF document text
    • http://lamaded.mywebcommunity.org/al_quran_app.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426953/normal_5fc68e4cc5c3b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403563/normal_6026d43d09412.pdfIn PDF document text
    • http://wijofotezopadik.medianewsonline.com/geralds_game_movie_plot_summary.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408586/normal_601123cb1a61a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384828/normal_5ff1490c2571a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482648/normal_5fcb04799394c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/viwoxuz/2014_kia_cadenza_owners_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27b0a836-e02b-490a-96a2-98a4330b260d/72138041364.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9a2351b-1c1c-4881-970a-0d12b527413b/intermittent_fasting_its_benefits_and_risks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1976d4a4-34df-44b4-836e-5fce58c98459/jesavasuwaleninotimok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f32f82f-e7e5-432f-b1f3-10706cabe77d/1470891093.pdfIn PDF document text
    • http://liraperuwuw.atwebpages.com/what_are_the_steps_of_surya_namaskar.pdfIn PDF document text
    • https://8d5bcf17-53f2-4f21-b585-7a27aef14131.filesusr.com/ugd/7baf93_91195c688ade45b3933654c0a5089cde.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juduk/arbeitszeitgesetz_zusammenfassung.pdfIn PDF document text
    • https://s3.amazonaws.com/jefobexapulow/jovamexu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/502a1643-589c-4b90-b488-43e0b992e534/jomazuzitivaluvak.pdfIn PDF document text
    • http://forezepolutaju.onlinewebshop.net/bevekofinuguso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53c18708-ebe1-4891-ac60-aec847540b14/vezotaru.pdfIn PDF document text
    • https://s3.amazonaws.com/davubewu/360_degree_performance_appraisal_feedback_form.pdfIn PDF document text
    • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_62e0fa7a5e064519916a3dd87a65151f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/095f0365-e136-428d-9412-227c28656915/2008_jeep_wrangler_unlimited_x_motor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/456e50c4-8811-43a3-b280-1174680c7979/72532508154.pdfIn PDF document text
    • https://s3.amazonaws.com/safago/53_bank_open_saturday.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001016c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1016C 5940 bytes
SHA-256: 30b25971d0ae4452c2517d8a3ecefaf72cf965117fb27d9679f5aa263f65c9ae
font_01_sfnt_off0001159b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1159B 11068 bytes
SHA-256: 1880f015ff789f1f2b158342d062a13c6670a0ca482921ec145d35367e1a3304

Open this report in the interactive analyzer, or submit your own file for analysis.