Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d86676383cdb2e5…

MALICIOUS

PDF

97.0 KB Created: 2021-03-25 14:49:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bbf427c1359892275d727db0dbc7eeb4 SHA-1: d562ca8f8e32b0dbe2a96b30a1319f8839679023 SHA-256: 6d86676383cdb2e5b9193bda6a28c14e4612c6bbf7531b2e84ab6ca2fc7349d5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL pointing to 'dugedepap.ru', suggesting a phishing or malware distribution scheme. The document body, though partially obfuscated, mentions 'Pro launcher apkpure', likely a lure to entice users to click on the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=pro+launcher+apkpure
    • https://nibebelijatod.weebly.com/uploads/1/3/1/4/131452937/kimifubum_taraxisepusuxin_velatar_wijem.pdf
    • http://sale50.pro/hillbilly_elegy_free_downloadbrl1z.pdf
    • https://cdn-cms.f-static.net/uploads/4366331/normal_603696d176b97.pdf
    • https://cdn-cms.f-static.net/uploads/4501632/normal_6048dbc3a0e19.pdf
    • http://trychambre.xyz/fender_blues_deluxe_reissue_tubesqano3.pdf
    • http://leopards.space/184123838985h6g7.pdf
    • https://cdn-cms.f-static.net/uploads/4476437/normal_60463849b5801.pdf
    • https://cdn-cms.f-static.net/uploads/4450141/normal_605c85b6c9142.pdf
    • https://cdn-cms.f-static.net/uploads/4370780/normal_5fe6c59813542.pdf
    • http://erethiztzj.space/tissot_t-touch_connect_solar_smartwatch_review5fhu1.pdf
    • https://roviselazadavuw.weebly.com/uploads/1/3/4/0/134040559/fidesilubusejexux.pdf
    • http://mebelintera.ru/nursing_informatics_and_the_foundatium22p.pdf
    • http://raisinsapp.club/how_to_use_the_frigidaire_dehumidifierzjzzb.pdf
    • http://megahit.space/aesthetics_philosophyahexv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://083189c9-8220-4687-a375-57be19a37228.filesusr.com/ugd/909b15_88806757d5cf4e8fa1930cdab7d6c3ed.pdf?index=true
    • https://42cc6f6d-9125-48bc-bce4-1bf15f49b1be.filesusr.com/ugd/7c30af_7fe90a4c6870497fa74dc6b4e7ccd3c0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/78b51336-95b0-4b66-a5ef-c34c45ec5046/delomapepur.pdf
    • https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_ecf4676b114d4f5484d54a8464a115f3.pdf?index=true
    • https://2863666b-9d79-467d-9aad-9eeb6dafbdf2.filesusr.com/ugd/6ee3eb_87759deb1aa9489ab63cd8920e1c984a.pdf?index=true
    • https://24218389-b518-4ca3-8548-65eaf758daa4.filesusr.com/ugd/c836c3_09e4842ad0c74554a70b6060801aba3f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5897436a-b15f-4279-afe1-14a62424a87f/botezatirepaza.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2d0.bin
4e1a9c4cb32f1bc4ff176ae4dc1460c31b2d267bf2def0252f23ad2731e7be72		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2D0 6588 bytes
font_01_sfnt_off0000f318.bin
460e00a871098a99b7da33cb20666b18352cbe452110937ff34af5d878d24d4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF318 4868 bytes
font_02_sfnt_off000103f5.bin
6e49b7f28c0d3e562570775c5435ba137812ade14e7960f6f8e05da83137de5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103F5 4908 bytes
font_03_sfnt_off00011498.bin
fe8b7540a494531d20704a615bc1856af617727039375bda846b8e2dfe8819e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11498 8592 bytes
font_04_sfnt_off0001315e.bin
022b0fb10ccfd8ff8f7618bfd2c598994c9ebd06ebdc8f9d35f197ae9270ed06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1315E 16284 bytes
font_05_sfnt_off00015dc5.bin
edbfb916c335a7ff0ad232f982c0c223986bdb7c8e9cd23b59033f187c95211f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DC5 16264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.