Malicious PDF — malware analysis report

Static analysis result for SHA-256 5695fbcf07476b04…

MALICIOUS

PDF

80.5 KB Created: 2021-03-30 11:27:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: a6b8f79123c1f68b0759cd50d9b97a3d SHA-1: 55bc020e7ba738fe267d631fd114a3aaba5f483b SHA-256: 5695fbcf07476b0490a9a4657c93a26b49e487908f6ce5b5d116e90c1ac35c10
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm designed to generate SEO traffic. One of the primary external URIs, 'https://midufefew.ru/award?keyword=space+articulation+and+territoriality+in+architecture+pdf', is suspicious and likely leads to a phishing or malware distribution site. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=space+articulation+and+territoriality+in+architecture+pdf PDF link annotation
    • http://opticsystem.website/do_they_still_make_polaroid_600_filmnzxvb.pdfIn PDF document text
    • http://myfoxing.online/947371214885jfj7.pdfIn PDF document text
    • http://qqkaxes.xyz/pulojawogupafise1c4j.pdfIn PDF document text
    • http://hushseo.online/how_to_increase_emotional_intimacy_in_marriagebn5he.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed6d0759-335a-4462-97f8-58d23b42a89c/how_do_i_become_an_appliance_repair_technician.pdfIn PDF document text
    • https://s3.amazonaws.com/liwara/monthly_meeting_room_schedule_template.pdfIn PDF document text
    • https://814cba0f-f649-4223-bfe6-7884e6e02b9d.filesusr.com/ugd/c1108c_8d530521eba44d7cb74a9c782f9d409d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a7881f8-d6bb-47a9-ba07-6f9997636f5e/html_css_javascript_black_book.pdfIn PDF document text
    • https://s3.amazonaws.com/baposivarabuj/worksheets_for_personal_and_possessive_pronouns.pdfIn PDF document text
    • https://s3.amazonaws.com/pevarijidasalop/how_to_get_dataflow_final_report.pdfIn PDF document text
    • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_7da550badade4ddb9b66076de0a3b45f.pdf?index=trueIn PDF document text
    • https://b81e1767-bb0d-4562-9f98-cfef66859bb1.filesusr.com/ugd/b48b60_b3b90f181c7940468011a189e9306d8f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/91d74744-97c6-4275-a5d6-5a80fc563ad4/34114266168.pdfIn PDF document text
    • https://s3.amazonaws.com/dobikasukavu/las_vegas_events_entertainment_guide.pdfIn PDF document text
    • https://460eb545-5389-4aa9-9e78-d1074a8bca0c.filesusr.com/ugd/21a131_2b85c82fe4c04826b723d864970a3f14.pdf?index=trueIn PDF document text
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_43112e44c6e44a3987b8c13182591ece.pdf?index=trueIn PDF document text
    • https://70848fb0-0fd0-490a-9360-2ffa38fc212c.filesusr.com/ugd/08e331_3a008c5b9b724da1be772d550cb3efa5.pdf?index=trueIn PDF document text
    • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_1031a82625aa43428a843fbef6628bd8.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9ED 5268 bytes
SHA-256: 2081a465bf894bcdc47c4adf7bd13ca7e85166583d477b5f48e3c2f7b543852a
font_01_sfnt_off00010bdb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BDB 11636 bytes
SHA-256: 43acf70662422d9bb3a73d9937c57c2fd7ea64391854322f0638ed9603bc4dbc

Open this report in the interactive analyzer, or submit your own file for analysis.