Malicious PDF — malware analysis report

Static analysis result for SHA-256 747fd7afa2dbffab…

MALICIOUS

PDF

69.9 KB Created: 2021-06-04 05:29:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 7c0d2f25175359bbf28933733a626499 SHA-1: 041a9ee0a5e099424d5f425067e18a2d74ce4e4a SHA-256: 747fd7afa2dbffab7a788ab6513bcb2d97f83c07633859a2ddb09bbebf6be6a1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, and contains a large number of external links, suggesting a link farm or phishing attempt. The PDF_SEO_LINK_FARM heuristic indicates a deliberate attempt to create a large number of links. The primary malicious URL identified is fokemale.ru, which is likely part of a campaign to drive traffic or distribute additional payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=pronoun+agreement+worksheet+with+answers PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4456999/normal_5fca09f6c4508.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385424/normal_6035e535c8ee1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416495/normal_604d3d08e9535.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388424/normal_604b21a7ebec8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379846/normal_604a68ae65884.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388060/normal_60385d9193c34.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381752/normal_5fcf8683b3086.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500895/normal_6061c708c823d.pdfIn PDF document text
    • https://damafurota.weebly.com/uploads/1/3/5/3/135337485/leponudubijiponar.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456372/normal_5fd98a5e1870c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463010/normal_601e22237b710.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412415/normal_60565ffd459d8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408462/normal_60622b46da28e.pdfIn PDF document text
    • https://rojusonevupa.weebly.com/uploads/1/3/0/8/130814232/7963cbd80cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463532/normal_602b2529b1f4b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422385/normal_601e76e08009c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483854/normal_6005eba829b29.pdfIn PDF document text
    • https://nexolibevi.weebly.com/uploads/1/3/4/4/134463206/paveloseroxoj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c34982c5-fd9f-4503-a7b8-20d18b20967e/97418283781.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5bb66d4-12fe-447e-9897-dde7705de09e/satixetebalu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/592d670f-4ca6-4c3c-8a22-5d4e322069c4/winazewedivakavizinepozu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c71b1b11-ee4d-4332-a241-713840363c26/mexujuwebozulores.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4E2 5224 bytes
SHA-256: 8bfbf33d57586bc06b7e26be9902f639960bd80f598a0c65ca6ba2f589cbac44
font_01_sfnt_off0000e694.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE694 10392 bytes
SHA-256: e1b590c62fcf429616439970f3ec70a1dbc1f20c3681cddd251d1a50fca7c683

Open this report in the interactive analyzer, or submit your own file for analysis.