Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dd95044f3e84976…

MALICIOUS

PDF

79.1 KB Created: 2021-03-22 19:33:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eff24b2529d4ee1b2461d2bdff863eef SHA-1: 41ab59755404256ed61ec5c65da8102babcd14d0 SHA-256: 7dd95044f3e849764e13bc4cc64fb5c3f9a902006c27c98d49e1bfb06f688cc5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a technique often used in SEO poisoning or phishing attacks to redirect users to malicious sites. The heuristic PDF_SEO_LINK_FARM indicates a large number of external links, with a specific example pointing to 'https://dafemum.ru/wix?keyword=james+henslin+essentials+of+sociology+13th+edition+pdf'. ClamAV also detected this as Pdf.Phishing.Trojan, further supporting a malicious classification. No scripts were extracted, but the presence of embedded URLs and the link farm strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=james+henslin+essentials+of+sociology+13th+edition+pdf
    • https://gekuraneg.weebly.com/uploads/1/3/1/6/131637503/5952161.pdf
    • https://cdn-cms.f-static.net/uploads/4448743/normal_602231ca427e0.pdf
    • https://cdn.sqhk.co/rotuzuwibi/aWicJic/lurixopunip.pdf
    • https://cdn.sqhk.co/safajoju/hhggfrM/forklift_truck_accident_report.pdf
    • https://zogeliwev.weebly.com/uploads/1/3/4/3/134353139/d72909d393dba21.pdf
    • https://tokuguzeg.weebly.com/uploads/1/3/4/4/134464653/julevejigosabizelupa.pdf
    • https://static.s123-cdn-static.com/uploads/4420237/normal_600941787261e.pdf
    • https://meliwajovogowuw.weebly.com/uploads/1/3/4/4/134481672/6975409.pdf
    • http://modebedunizux.iblogger.org/32453737516.pdf
    • https://federadedeladol.weebly.com/uploads/1/3/4/6/134626130/wunalupekufeta.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://054d5c26-596f-48a3-87a7-0fc79031e5db.filesusr.com/ugd/599026_7b5fba34e5674e11b98ae847c77c56a0.pdf?index=true
    • https://5c2cca0d-3a4e-48b0-93bf-8ac6c0c026cb.filesusr.com/ugd/271e65_650252f4d89d40539edafc2c797aad15.pdf?index=true
    • https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_21d38b24fdf34d39822b0f939bd4686d.pdf?index=true
    • https://dc688580-c0ec-4ade-910b-7abffd870ab4.filesusr.com/ugd/096b61_a023588a4e25456eb6f7d09a520ab482.pdf?index=true
    • https://2ea3657d-1c4c-40dd-8491-58aeeb8dc933.filesusr.com/ugd/18a85a_1365a3d682a143cb8d4e8dc68208dd38.pdf?index=true
    • https://59b7e61f-9850-45ee-add2-e9646db267e4.filesusr.com/ugd/5b9365_4973ef1b80714747a830e5179da9629f.pdf?index=true
    • http://junipom.rf.gd/guxamaxesajalepod.pdf
    • https://5c126656-fc4f-473b-8c99-11744d2e1b96.filesusr.com/ugd/abd8ec_f51b7bc950ec4e88920fd8dc3af35470.pdf?index=true
    • https://05e27880-d5e1-4d3d-8428-ba943e9300bc.filesusr.com/ugd/b56239_d8d025f29bf0461ab77adfad1d3c19f5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd7b.bin
4222a262402f2ae34070bdff3a1613810423fe49e37deba12f85654dba5de1df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD7B 5780 bytes
font_01_sfnt_off0000f120.bin
b81d53df6ddffd7fa0c17973b199b46c45168d67ed9e8778187f64009f16614e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF120 12144 bytes
font_02_sfnt_off000119c4.bin
462d13bd97d7d9b38b38dac4ddb889f891d4742debcdf3bbf084b15d68e01d41		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119C4 16084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.