Malicious PDF — malware analysis report

Static analysis result for SHA-256 6663a2fcb8112e3e…

MALICIOUS

PDF

80.4 KB Created: 2021-03-11 18:09:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78c5fb2107425c5e357afd6211f9b732 SHA-1: 3bc8fbd87705ad1f3afa88e3888fd6279ee51e51 SHA-256: 6663a2fcb8112e3e1fbd477a2ce0ebe8e05ef02a6bc268bf490bf10adb0609d7
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, including a link farm heuristic firing, suggesting an attempt to direct users to malicious websites. The primary URL, 'https://midufefew.ru/award?keyword=holt+physics+textbook+2020+pdf', appears to be a lure for users searching for educational materials, likely to host phishing content or malware. ClamAV detection and ML classification further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8184

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=holt+physics+textbook+2020+pdf
    • https://cdn-cms.f-static.net/uploads/4411709/normal_603d89229ddc4.pdf
    • https://cdn-cms.f-static.net/uploads/4410211/normal_601fe20c7560b.pdf
    • https://cdn-cms.f-static.net/uploads/4379473/normal_6012fb34579d7.pdf
    • http://zibepifutidi.sportsontheweb.net/desaropes.pdf
    • https://cdn-cms.f-static.net/uploads/4452154/normal_60112875d94dd.pdf
    • http://zozegakipuvi.iblogger.org/africa_toto_sheet_music.pdf
    • https://cdn.sqhk.co/jifegusewe/igd3Zjd/tropico_4_modern_times_buildings.pdf
    • https://cdn-cms.f-static.net/uploads/4503050/normal_600a092297a9b.pdf
    • https://cdn.sqhk.co/forinabam/hSjegt0/ludo_mania_2019_dice_game_apk.pdf
    • https://static.s123-cdn-static.com/uploads/4393346/normal_5fc9a5102f87b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://diwesetudu.epizy.com/hamilton_beach_steamer_times.pdf
    • https://d2faa26e-66ca-44cd-8f84-883624a71019.filesusr.com/ugd/dbbfd0_5e7f764ca0a944eea81d271e95992f31.pdf?index=true
    • https://b7f5b04e-b247-49a4-9dc0-39f0c843ec09.filesusr.com/ugd/b56f86_626c8ff6828041d9906bdd7e8285ce6b.pdf?index=true
    • https://5637a596-61ce-4e67-8953-8fd9cb84b940.filesusr.com/ugd/c20ea7_bbf82796dc4b4b99bb02573011b936be.pdf?index=true
    • http://luvabokinoleg.onlinewebshop.net/the_road_less_traveled_ebook.pdf
    • http://nerelikeg.epizy.com/coronary_angiogram_report_reading.pdf
    • https://46fb9a51-9e16-4ad8-811e-2f7ed01702f7.filesusr.com/ugd/53363c_ab2cb7c0148f4fb298771a55f0acc682.pdf?index=true
    • https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_1606619961504c03bdd3fb8106c540df.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d62.bin
efe9583389841c06f006c6df8780a37d8b69043be56fc9f25466712186805a91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D62 5228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.