Malicious PDF — malware analysis report

Static analysis result for SHA-256 713c860c1efc5c68…

MALICIOUS

PDF

77.1 KB Created: 2021-03-21 23:43:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 14838c4961754f64110239bd25d87cec SHA-1: 19801c25cdb8748efbdac2f222b83c319d63e650 SHA-256: 713c860c1efc5c682bb043ddebfc71e2441688ea7932f7c19a7302bde42f53c1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or malicious content delivery attempt. The PDF contains a large number of external links, suggesting a link farm or SEO manipulation tactic. One of the extracted URLs, 'https://fokemale.ru/strik?utm_term=aimee+franklin+da', is particularly suspicious and likely leads to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=aimee+franklin+da
    • https://cdn.sqhk.co/puwipaneke/YibUdvf/super_star_head_soccer_tournament.pdf
    • https://guduzuzej.weebly.com/uploads/1/3/1/6/131606672/dazejuzoni_sopebu_mewis.pdf
    • https://cdn.sqhk.co/rurufimibiwe/ieTgjja/mupovamoniluwafefuzij.pdf
    • https://cdn.sqhk.co/tinodifozeza/gjihhjd/91843832574.pdf
    • https://cdn.sqhk.co/kokuxisa/eMgf9if/matrixyl_3000_serum_reviews.pdf
    • https://cdn.sqhk.co/samanugutu/iiicGCa/furuvuzimule.pdf
    • https://cdn.sqhk.co/lovaxixifew/hhfajc5/north_texas_conference_umc_appointments.pdf
    • https://cdn.sqhk.co/romilononove/1gejjyd/xowizabowafimovajam.pdf
    • https://cdn.sqhk.co/didowolikex/0nMihXG/magixeliju.pdf
    • https://cdn.sqhk.co/satidaruxami/SKjiU3q/vejemomazonurebiwodulol.pdf
    • https://sivamodinuna.weebly.com/uploads/1/3/4/7/134762665/purokefigubifanunu.pdf
    • https://cdn.sqhk.co/puwukuwos/7dXidjd/61992245193.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4a5660cc-52a2-48ff-9acb-4b4f1704cb6e.filesusr.com/ugd/81868d_c6016cd2a739489fbb07f1ac72d2cf02.pdf?index=true
    • https://850a36a1-966c-46c3-86ed-e15bcb5778a7.filesusr.com/ugd/ede58b_5e0e9dbd0c2e4bdead008ce8f27f7068.pdf?index=true
    • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_4499d6a80eae46a195e6be5474563bd7.pdf?index=true
    • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_feabda3d449e4270836e8f0031cb89ca.pdf?index=true
    • https://8fa10226-37c2-454d-bd65-ced70ecbf0c4.filesusr.com/ugd/c34aa9_0228502bb3c74f209bb5d9c807be291d.pdf?index=true
    • https://f9a132f0-acc9-4761-b7d8-38025aedd849.filesusr.com/ugd/5c71d6_c6c372a9ceb74f4d80af8e03539a0e5b.pdf?index=true
    • https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_e687d194cdda46d292b8bb940b70b98c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efb3.bin
8d766f6340a0832351ad0381e14df3608981ec07b4d2ee828ee28c1f542fd7b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFB3 4928 bytes
font_01_sfnt_off00010062.bin
c1d2fd65128a3683a053a7cb7e01bd4618dcdf61e40cbecb22769a08d0908077		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10062 12092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.