Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c856d31d348a06a…

MALICIOUS

PDF

79.7 KB Created: 2021-03-21 05:51:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2fe45607ba05a6712c5b8dbe56e292b2 SHA-1: 6358ad52f85ae50226abb3a2aa14c010330b8ecf SHA-256: 5c856d31d348a06ad51f09bfd45b94f96b020d7e32829ca68a620fa0eedb5e58
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous external links, including one to 'druttle.ru', suggesting a link farm or phishing attempt. The presence of embedded URLs and the overall structure point towards a phishing or malware distribution scheme, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=nikon+scope+warranty+registration
    • https://static.s123-cdn-static.com/uploads/4414860/normal_6003879dc35ad.pdf
    • http://tafugegajotu.mygamesonline.org/how_to_scan_double_sided_documents_on_hp_officejet_4630.pdf
    • https://cdn-cms.f-static.net/uploads/4426059/normal_602986755535a.pdf
    • https://cdn.sqhk.co/selusujava/jNuzDgj/vidmate_2017_app_for_pc.pdf
    • https://cdn.sqhk.co/navimoxa/a7gddic/kigujixulosuvesanojopedod.pdf
    • http://fekosuse.getenjoyment.net/83217987614.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7aff118d-26f6-4d76-9bc9-1838009e7274.filesusr.com/ugd/f80014_ee2dd01c42854d53aa9428f8a21b9bce.pdf?index=true
    • https://331e17ce-4321-42a7-89aa-067eaa3daeeb.filesusr.com/ugd/6576ad_3ae7eac3200b407f925e9b194053d323.pdf?index=true
    • https://c4cd0dbc-23d7-4f11-b65f-2561cec8abe5.filesusr.com/ugd/516793_c4cdc18782e54565add78ca05e4529c8.pdf?index=true
    • https://858e1da1-ad31-4e5b-aec0-89c59c6c71f6.filesusr.com/ugd/6240f8_5cdabd3ba12c413398106e54c27b0f96.pdf?index=true
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_31c07e3f489641babd5428635460113c.pdf?index=true
    • https://s3.amazonaws.com/zoromexemuzid/cet_form_2019_official_website.pdf
    • https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_3ad868a72dce418da39812407c5c8288.pdf?index=true
    • https://s3.amazonaws.com/vexeliku/lunofesenuzekemafogip.pdf
    • https://6cdf8c5e-36a0-4b6d-987f-32d3d50030cd.filesusr.com/ugd/3c2e2e_b8ae7e03ae3f4ccd9dcbcce2c8db254e.pdf?index=true
    • https://f579be4a-c2ec-451d-94ee-532237c06880.filesusr.com/ugd/9f6a24_41d88863c49045aa9873ecfc16144790.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa6b.bin
c8c6b739d7b290baaa6d9a38672bb9b9fab87ef1e7487b84dd526e28507839ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA6B 5296 bytes
font_01_sfnt_off00010ca7.bin
68ca89cb9e8b9483b0e6b36529858d61c4056979db64bd849d1509d5069f6e36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CA7 10928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.