Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d4983a3eb01ddbf…

MALICIOUS

PDF

75.9 KB Created: 2021-06-01 12:26:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc308a962ee8b7324adf8fa1220981c3 SHA-1: 74d88e63b616ba1ddc31ceb0f1b9cafc73fa44e8 SHA-256: 6d4983a3eb01ddbfaa7ac2d51241b7234f5020aa18b82c255d93bab46cf3b694
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by ClamAV as a phishing trojan and by an ML classifier with high confidence. It contains a large number of external links, many pointing to PDF files on various hosting services, suggesting a link farm or SEO manipulation tactic. One of the primary external links is to 'crewmak.ru', which is likely part of a phishing or malicious redirection chain. No scripts were extracted, but the PDF structure and numerous external links indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=how+to+escape+hello+neighbour+act+two
    • https://xebolusuzibukun.weebly.com/uploads/1/3/4/5/134506512/sojowosapojilizu.pdf
    • https://vafeperaj.weebly.com/uploads/1/3/4/5/134586379/1351327.pdf
    • https://wisowoturap.weebly.com/uploads/1/3/1/4/131453432/bcd2a2feb5046.pdf
    • https://rupekiduwixe.weebly.com/uploads/1/3/4/7/134774185/8a1622eaa17.pdf
    • https://nibevomixosu.weebly.com/uploads/1/3/4/1/134108547/9122686.pdf
    • https://bazulezegit.weebly.com/uploads/1/3/4/3/134372971/geduzavumu_mavakiduviz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://degenazi.pbworks.com/f/87076460653.pdf
    • http://lugozamuxika.pbworks.com/w/file/fetch/144417282/how_to_find_moodle_answers_with_inspect_element.pdf
    • http://degenazi.pbworks.com/f/vasurezapelemusubifide.pdf
    • http://garigor.pbworks.com/w/file/fetch/144427533/test_ingresso_bocconi_2018.pdf
    • https://uploads.strikinglycdn.com/files/48853946-3e3c-44c6-a232-97232db15944/povifibibiwukigaseranuxig.pdf
    • https://uploads.strikinglycdn.com/files/d8714a82-ab70-47ca-9b0e-8c955abbbcd9/what_is_the_moral_of_demeter_and_persephone.pdf
    • https://uploads.strikinglycdn.com/files/168e5714-55a1-48b7-9340-0e82e121b6dd/83392527705.pdf
    • https://uploads.strikinglycdn.com/files/9f372099-893d-4fa8-8523-878be54ba518/samsung_sm-t350_case.pdf
    • https://uploads.strikinglycdn.com/files/e8eee7c6-a248-48a4-8b25-ad7fe40fe5be/bateria_de_riesgos_psicosociales.pdf
    • https://uploads.strikinglycdn.com/files/d4c60f37-d697-4157-91f6-4e6bc1a75561/gilenugoduzatebanesuni.pdf
    • https://uploads.strikinglycdn.com/files/35293764-e2ff-469d-877c-c884339a01ad/what_does_clarion_call_mean_in_the_bible.pdf
    • https://uploads.strikinglycdn.com/files/f8ae86e7-d106-440c-8f29-04431ab7330e/71551909768.pdf
    • http://mefijunov.pbworks.com/f/what_is_classroom_control.pdf
    • https://uploads.strikinglycdn.com/files/56a6691a-776c-489d-81c7-07bd680faa0a/3215159742.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea18.bin
7133059be897631547b109f2444994cb70a4048b8f53b932326ecb593c58db1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA18 5388 bytes
font_01_sfnt_off0000fc75.bin
8b20dbb086473ea1370b496e9d6db3bf2c60224881163318ed59e767cd3cadc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC75 11204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.