Malicious PDF — malware analysis report

Static analysis result for SHA-256 574f401fa9bb954d…

MALICIOUS

PDF

66.1 KB Created: 2020-11-25 21:10:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 6f792f2d3eed63b4a2f38404932a10d8 SHA-1: 0f475ab354f064d10dca53d39deb2d20a8f84bad SHA-256: 574f401fa9bb954d7c06b346c731ea21d60eb8c626be478758b761bbee44b4e6
254 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a lure to impersonate a cloud document, instructing the user to enable editing, which is a common technique for malware delivery. It also contains a link to a known malicious redirector, indicating an attempt to lead the user to malicious infrastructure. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?utm_term=how+to+edit+margins+on+google+docs+app In PDF document text
    • https://cdn-cms.f-static.net/uploads/4382208/normal_5f90adb4b998d.pdfIn PDF document text
    • https://sigegasolo.weebly.com/uploads/1/3/4/7/134732441/5014092.pdfIn PDF document text
    • https://disadaniti.weebly.com/uploads/1/3/4/4/134463451/nememosesepeg.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415073/normal_5f9d748bdca5c.pdfIn PDF document text
    • https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/sebir.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374957/normal_5f9090876ba94.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454184/normal_5fa1c5aec6b1e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc3ba737-4c8a-48ef-87ea-6b6df75af65d/bibobu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a17d5723-7a0b-4cbe-8692-7b3e50b372a5/13913088847.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a1afeb5-e426-4229-ba91-0abf2e8b5b0d/rokemevisaf.pdfIn PDF document text
    • https://s3.amazonaws.com/nigimul/story_elements_handout.pdfIn PDF document text
    • https://s3.amazonaws.com/fifuto/44935473323.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c613.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC613 5448 bytes
SHA-256: d752bada1ebd9ae6b12b9279ed0f92327dcf61dff2fa55255b62b729dc724cb6
font_01_sfnt_off0000d88f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD88F 10256 bytes
SHA-256: e8e6b5864efd2d5e31c834653db95b07907ea6cf25c7a8fec5318cfe2908016e

Open this report in the interactive analyzer, or submit your own file for analysis.