Malicious PDF — malware analysis report

Static analysis result for SHA-256 54a767c1ed6c92bb…

MALICIOUS

PDF

94.7 KB Created: 2021-05-30 21:05:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: c3cdfbc7bb39d0b1087062279cf13c80 SHA-1: 59e5d7f93436404d7404ce258c800dcb09e172e6 SHA-256: 54a767c1ed6c92bb36f10d1c0624354ee902e4256f508a57ba65393229036a06
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The primary URL found is fokemale.ru, which is likely part of a link farm or phishing campaign. While no scripts were explicitly extracted, the presence of numerous external links and the ClamAV detection suggest a malicious intent to redirect users to potentially harmful content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=apfelkuchen+mit+streusel+und+apfelmus+springform PDF link annotation
    • https://jejojoroliwe.weebly.com/uploads/1/3/4/3/134310913/411a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418755/normal_5fd18133990c8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489255/normal_5fc5f184084e9.pdfIn PDF document text
    • https://vemomomofaj.weebly.com/uploads/1/3/2/7/132740815/dovekalakiruwuloleki.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491933/normal_5fdf5a793f1f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472208/normal_5fd383f8f230d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4428052/normal_5ff89d80c9160.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485162/normal_6036883d221a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425230/normal_604e4f6f072cb.pdfIn PDF document text
    • https://lidekejim.weebly.com/uploads/1/3/4/3/134331166/2c58afde53bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471474/normal_6044faf31a2a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365657/normal_601e3dd20e5f5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4499958/normal_5fcd64b4a82e7.pdfIn PDF document text
    • https://sinepakeje.weebly.com/uploads/1/3/4/4/134490574/9e610.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471988/normal_5fd267bb40742.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451561/normal_60223a92bd259.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423430/normal_605b85b92ef12.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d590810e-4b03-4dfa-bcf8-a146b6b81918/how_to_make_xref_grayscale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67d379c4-1b41-42f1-8996-c6fb11cd45fd/lorono.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87b0b76a-a3d4-42a6-adf1-c5b9c50c1164/fire_and_ice_hvac_wilmington_nc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d02458a-0ed0-4fd1-a224-fbb5f8f8e364/watch_the_hunger_games_mockingjay_-_part_2_online_free_123_movies.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6619c0b3-9248-4d55-9e1a-67d79ce35188/how_many_tribes_are_in_the_navajo_nation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9390d5db-b02a-4bf2-9e10-7c57eb69e62c/dell_latitude_e6410_broadcom_ush_driver_windows_7_32_bit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb6c97b9-59ca-4840-891f-e46c055675b0/93390937373.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100E0 6440 bytes
SHA-256: 3d4760ca295192c89086870ebbac49c5a5945404ea6ab57fca452cf2db5f569a
font_01_sfnt_off000110d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110D4 5624 bytes
SHA-256: 0ce006e253e9c8facf0bda4fb77238662bbcade6e455a7d3d955bec0d4410f41
font_02_sfnt_off000123be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123BE 1800 bytes
SHA-256: daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e
font_03_sfnt_off00012c4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C4C 12284 bytes
SHA-256: d1aed858586f074ba98af3e2a37b25396120721d69a10e601e290a9ae540d905
font_04_sfnt_off000154ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154AC 16264 bytes
SHA-256: 1a1b9a9afb879d8b62e3dc903c8096e9b8f2250cde523cf43efa9f6da2e903c3

Open this report in the interactive analyzer, or submit your own file for analysis.