Malicious PDF — malware analysis report

Static analysis result for SHA-256 75a03d61301aaeb9…

MALICIOUS

PDF

79.6 KB Created: 2021-05-31 05:41:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 385ebd2939f8054f13debdc679cb66ec SHA-1: d47cdb15b1b89f4dd8bb307c8a40caa7e8267e0b SHA-256: 75a03d61301aaeb9c75f6ce9d754d193e183f63e369a1fa9bc39430b6fb768e5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for an external URI, pointing to a URL that appears to be a lure for downloading a movie. This URL is likely malicious and intended for phishing or malware distribution. The presence of a large number of external links also suggests a link farm or SEO poisoning attempt. ClamAV detection and ML classification further support the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=download+hamlet+movie+mel+gibson+full
    • https://static.s123-cdn-static.com/uploads/4471249/normal_5ffb4bb771d5e.pdf
    • https://wulukisogexoz.weebly.com/uploads/1/3/1/4/131438059/2170733.pdf
    • https://nuluvefum.weebly.com/uploads/1/3/3/9/133999802/1111613.pdf
    • https://kinigapiluxuke.weebly.com/uploads/1/3/4/8/134863840/01e7a3e796c.pdf
    • https://zopogunonezaso.weebly.com/uploads/1/3/1/6/131637395/fed1f8.pdf
    • https://cdn-cms.f-static.net/uploads/4371788/normal_6019142d53268.pdf
    • https://pafajawu.weebly.com/uploads/1/3/2/6/132682051/vezabigekal.pdf
    • https://jatisarekitikez.weebly.com/uploads/1/3/4/6/134661612/3591089.pdf
    • https://weworikifuga.weebly.com/uploads/1/3/4/5/134515792/4392116.pdf
    • https://vutajavegev.weebly.com/uploads/1/3/4/0/134040502/nujulox-kumasunazuf-wewadi.pdf
    • https://tutobino.weebly.com/uploads/1/3/2/6/132695576/4680126.pdf
    • https://namazowofurap.weebly.com/uploads/1/3/4/3/134372349/zowubafidadarad.pdf
    • https://sajixigepanosu.weebly.com/uploads/1/3/1/0/131070231/gotanu.pdf
    • https://ralokokotozupar.weebly.com/uploads/1/3/4/3/134340958/ae719.pdf
    • https://static.s123-cdn-static.com/uploads/4422137/normal_5ff549d5c682d.pdf
    • https://berezudimideri.weebly.com/uploads/1/3/7/5/137512898/4388638.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/98a61200-9897-4576-b6c5-0f8326eecae9/saitek_x52_pro_manual.pdf
    • https://uploads.strikinglycdn.com/files/58a69571-2fcb-4934-a490-9b405d75865b/trane_humidifier_not_working.pdf
    • https://uploads.strikinglycdn.com/files/b12e01ad-7d6c-4f18-be07-00ba1c1068bc/feelings_wheel_poster_uk.pdf
    • https://uploads.strikinglycdn.com/files/2beb7da2-10da-4ee0-b83f-9240658c8b16/galebanuwuzugopul.pdf
    • https://uploads.strikinglycdn.com/files/5ed3f38d-529a-40a8-bb16-d08b42282bb9/does_chrysler_offer_lifetime_warranty.pdf
    • https://uploads.strikinglycdn.com/files/23941afb-83ca-499e-bee0-4316f3aaad08/43733424726.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8b3.bin
0ad7cee8d05551053786b1953345712620c93a39e4f8627282ee9dd5b28816f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B3 5516 bytes
font_01_sfnt_off00010b73.bin
733e543cbf5e12deb176715338fb1355b043c0c7baa729b0e9f19977beef029a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B73 10976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.