Malicious PDF — malware analysis report

Static analysis result for SHA-256 549d821b0ee7b93d…

MALICIOUS

PDF

74.2 KB Created: 2021-05-24 00:44:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1cd02f845e2e9714ced511a6dab93c57 SHA-1: f6bbbe281829b698e57b84466a21a6bbcdd50bde SHA-256: 549d821b0ee7b93deb2141cc4966693fe99b13636582896cf558d2a6c9e5b6a3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One of the primary URLs, 'https://fokemale.ru/strik?utm_term=assassin+value+list+march', is flagged as unknown reputation, suggesting a malicious intent. The ClamAV detection and ML classifier further support its malicious nature, likely as a phishing or spam distribution mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6727

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=assassin+value+list+march
    • https://raxaregos.weebly.com/uploads/1/3/4/3/134363135/2608eb2dbca775.pdf
    • https://toxujubew.weebly.com/uploads/1/3/1/4/131437446/cf97807.pdf
    • https://wedemewimobuxet.weebly.com/uploads/1/3/4/3/134309086/1c0f54b679.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nuxulikiwab/13206137214.pdf
    • https://s3.amazonaws.com/watajive/fowixuvukeraparejo.pdf
    • https://uploads.strikinglycdn.com/files/05b9dc9d-71f0-4a65-90d4-b5717aa8a944/xetaxatukoralaj.pdf
    • https://uploads.strikinglycdn.com/files/fc8ea5cb-c077-4e77-b8a1-d1d54d0580a8/96031090966.pdf
    • https://uploads.strikinglycdn.com/files/1287e5c4-c9b6-4955-bb0b-3548face470b/poxulomatuzagowamotexa.pdf
    • https://s3.amazonaws.com/mujevubutukoxu/zutezagabepopojenoxuvom.pdf
    • https://uploads.strikinglycdn.com/files/1c18500f-8dc0-4537-915c-dbd478a0aa2a/how_to_replace_a_pull_cord_on_a_yard_machine_snowblower.pdf
    • https://uploads.strikinglycdn.com/files/904e4971-ca8c-4296-88ec-7edf02364e26/tosegavemizibebaxafux.pdf
    • https://uploads.strikinglycdn.com/files/a86a034b-8888-497e-a14a-52fe8519d277/herstein_abstract_algebra_solutions.pdf
    • https://uploads.strikinglycdn.com/files/f5a64cbd-ce6e-4cff-aec1-87102b413af9/clinical_pharmacology_made_ridiculously_simple_download.pdf
    • https://uploads.strikinglycdn.com/files/d7df9903-eeca-471d-8eed-fb5581bf20b0/which_sat_prep_course_is_the_best.pdf
    • https://s3.amazonaws.com/sogovekevi/how_do_you_set_the_time_on_a_sony_dream_machine_icf-c318.pdf
    • https://uploads.strikinglycdn.com/files/a56fa3b7-b07b-4eb0-8391-721245f12369/turimotalotipigajafusagu.pdf
    • https://uploads.strikinglycdn.com/files/50ab04a8-c3df-447e-9e8d-495b640a1f65/toyota_camry_hybrid_price_in_kerala.pdf
    • https://uploads.strikinglycdn.com/files/fb00e24f-c121-4a02-9bce-620fe3265909/19640346608.pdf
    • https://uploads.strikinglycdn.com/files/ac820729-d645-4150-a528-9491896987d7/pizawojatajuregusuj.pdf
    • https://s3.amazonaws.com/fenatagazise/adobe_baskerville_font.pdf
    • https://uploads.strikinglycdn.com/files/6ed41dda-4048-4426-95b2-56695284f2d9/are_germline_cells_haploid_or_diploid.pdf
    • https://uploads.strikinglycdn.com/files/713442a5-efab-4b64-bb65-2dc95c472a49/93436145624.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f864.bin
f8737420b49cee97dc23c7ea92e5f78cacad31cf29bd30e5aa0fa442d499246a
pdf-font-stream PDF embedded font (sfnt) at offset 0xF864 5088 bytes
font_01_sfnt_off00010982.bin
50ff9831b1f756321f5009ebabb131acdd4b35eb93159821aeca62e83cac18e1
pdf-font-stream PDF embedded font (sfnt) at offset 0x10982 2888 bytes