Malicious PDF — malware analysis report

Static analysis result for SHA-256 712b1e4b02ebd96f…

MALICIOUS

PDF

76.0 KB Created: 2021-04-10 10:42:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68ace09ac84b290971f738a0e8835619 SHA-1: ef90df5162aa086efbd4e37d4dc6a66baeaf6afe SHA-256: 712b1e4b02ebd96ff4efd383448e439b5f824a8561cffc6a5d82412d404c8c47
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files. One prominent URL, https://dafemum.ru/strik?utm_term=types+of+data+analysis+methods+in+qualitative+research+pdf, suggests a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=types+of+data+analysis+methods+in+qualitative+research+pdf
    • https://static.s123-cdn-static.com/uploads/4462376/normal_60066038e2ca7.pdf
    • https://static.s123-cdn-static.com/uploads/4443326/normal_6005f51b2cb97.pdf
    • https://cdn-cms.f-static.net/uploads/4384633/normal_6019b6b857ba5.pdf
    • https://cdn-cms.f-static.net/uploads/4478414/normal_606c8fb3b9445.pdf
    • https://cdn-cms.f-static.net/uploads/4423136/normal_6027547dd638b.pdf
    • https://static.s123-cdn-static.com/uploads/4485445/normal_5ffc038232c50.pdf
    • https://latolupolazu.weebly.com/uploads/1/3/4/0/134017494/gatavibo.pdf
    • https://lexizade.weebly.com/uploads/1/3/4/3/134368494/f3b621.pdf
    • https://static.s123-cdn-static.com/uploads/4366011/normal_5fec8c2ae5a27.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sepawi/87748473677.pdf
    • https://s3.amazonaws.com/luropiw/android_smart_tv_box_online_india.pdf
    • https://s3.amazonaws.com/gifiz/kaspersky_antivirus_software_for_windows_10.pdf
    • https://s3.amazonaws.com/jotogorurekuro/la_biblia_de_nuestro_pueblo_luis_alonso_schokel.pdf
    • https://9a60fab3-6fb0-4be7-9305-b2e3cc44d963.filesusr.com/ugd/811c4f_e3d8a12f5a7e4569ad07bc99f91d2e6c.pdf?index=true
    • https://e3055f73-6236-423b-b810-4bc1a15f300f.filesusr.com/ugd/fa12d1_89d45482ce1e42a0844d8797e19863c3.pdf?index=true
    • https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_a40074896491467a9c20b414a6ebcc16.pdf?index=true
    • https://s3.amazonaws.com/lunojol/example_words_for_the_prefix_greg.pdf
    • https://s3.amazonaws.com/sivanira/46708048802.pdf
    • https://s3.amazonaws.com/nitirew/zotijekodopizife.pdf
    • https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_20f190a955f544589a0b1b99c4c7bbdd.pdf?index=true
    • https://s3.amazonaws.com/bagokiko/photoscape_x_pro_online.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea62.bin
37d195d54a4017ef5e4abfe5932ab6ef7a3258e88237d75bc00fb44f901da36e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA62 5632 bytes
font_01_sfnt_off0000fd6c.bin
df5ca1855bc71b84c80ba6fecb4b4df8a2f28e27125511ba9797175c8e7c5f41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6C 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.