Malicious PDF — malware analysis report

Static analysis result for SHA-256 6546dac57f5986c6…

MALICIOUS

PDF

84.7 KB Created: 2021-05-07 06:48:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: c8296ef15ed314f286da3a10bd410c5e SHA-1: dbff3a4b744153dd817eb6eefe9a18ae75a34d53 SHA-256: 6546dac57f5986c6f8ec3c3c43f34ea09cf6eec6e80c67d5e514df0d444b166c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical finding for a large number of external PDF links, suggesting a link farm or SEO abuse. ML classification and ClamAV also identified it as malicious. The embedded URLs, particularly 'https://dugedepap.ru/strik', indicate a likely phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards an attack pattern involving redirection to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=what+is+the+gothic+architecture PDF link annotation
    • http://gebojujefe.22web.org/how_much_does_a_microbiologist_earn_in_nigeria.pdfIn PDF document text
    • http://pofubodegi.iblogger.org/2006_honda_civic_ex_sedan_front_bumper.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fotepopunaj/mimipigutezilegaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b17ce28-b8e5-4f54-b956-e3aa2841483c/ponumaz.pdfIn PDF document text
    • https://s3.amazonaws.com/kavugusepe/free_catalog_design_templates_indesign.pdfIn PDF document text
    • https://d56a38bf-d62e-453c-9b5b-5b2fe88aea46.filesusr.com/ugd/359e64_f1ae35d5fb8a469e99650cbedcbe9873.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mexesazaxasa/xupofalawekozamoxuvegafox.pdfIn PDF document text
    • https://0d555108-1732-4721-8d72-76d747b2053a.filesusr.com/ugd/1b0481_5c6dba06b6144f14917bf98c4d6b631d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tigewibejageju/english_idioms_and_phrases_game.pdfIn PDF document text
    • https://s3.amazonaws.com/wuzalugiseto/40290566547.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9794a2cf-6de1-4829-b201-23e68a460e0d/e2_hitch_l-pin.pdfIn PDF document text
    • https://s3.amazonaws.com/kisimujuk/inconel_718_standard_sheet_thickness.pdfIn PDF document text
    • https://s3.amazonaws.com/napoledunadigo/sugeriduwevowaga.pdfIn PDF document text
    • https://9526c93a-d340-4dca-b5fd-2864ff0888c4.filesusr.com/ugd/4c3d6a_ad2f45f21dbd40318d80ffd1ceae51b3.pdf?index=trueIn PDF document text
    • http://fumexilali.rf.gd/college_sociology_textbook.pdfIn PDF document text
    • https://s3.amazonaws.com/dezajok/aleko_gate_opener_parts.pdfIn PDF document text
    • https://bdc3fad0-85dd-4e34-85f7-620d54d4ff6f.filesusr.com/ugd/10cedf_f29ce3ee72654f3686ac87356e5546a0.pdf?index=trueIn PDF document text
    • https://06e27459-8a58-4d01-a48e-f853eab966f6.filesusr.com/ugd/55f1a0_83c582c6bfad479ba38716a72129ca2c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/najipavez/97850118098.pdfIn PDF document text
    • https://s3.amazonaws.com/mefadedosuw/expert_interview_template.pdfIn PDF document text
    • https://8fa10226-37c2-454d-bd65-ced70ecbf0c4.filesusr.com/ugd/c34aa9_acfc4204c3f84146b28f6b9117a716ab.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011028.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11028 5044 bytes
SHA-256: 84b03f5fa8bda1771da750c0d90b9ae1d298a14deb28c333df86808da672f2f1
font_01_sfnt_off00012159.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12159 10700 bytes
SHA-256: 310a9088571062b2888ee498adec831482556f265c6a8f350534b40e9cde02c3

Open this report in the interactive analyzer, or submit your own file for analysis.