Malicious PDF — malware analysis report

Static analysis result for SHA-256 847a79452bc90d3e…

MALICIOUS

PDF

76.2 KB Created: 2021-03-08 23:28:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ae187a766e03854e29b40c6cb1fd579 SHA-1: 25a6e68f00450d6a00c092791e9c061d43b416ac SHA-256: 847a79452bc90d3ec75fe82e4103d0dd7ab34456fa8051f71e94ba4e77063c47
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external URIs points to 'https://dafemum.ru/aws?utm_term=can+you+retake+the+wand+test+on+pottermore', suggesting a phishing or malicious redirection attempt. The ClamAV detection and ML classifier also indicate malicious intent, likely related to phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/aws?utm_term=can+you+retake+the+wand+test+on+pottermore
    • https://cdn-cms.f-static.net/uploads/4446155/normal_60401a9394e5b.pdf
    • https://cdn-cms.f-static.net/uploads/4373526/normal_6021ecd103706.pdf
    • https://cdn-cms.f-static.net/uploads/4458633/normal_603aab0e97996.pdf
    • https://cdn-cms.f-static.net/uploads/4388038/normal_6015b7304fff1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/ec3572bf-e086-4b3c-81fb-0d94641e2c73/angels_on_a_pin.pdf
    • https://s3.amazonaws.com/wesezuzuvalirik/zerugudawaxigupax.pdf
    • https://1b6fe947-be7e-4494-9a94-f566f178d3d1.filesusr.com/ugd/89064d_5760aeb09de54538ab55c6d7c3be0dd1.pdf?index=true
    • https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_3120ca1341e24e1c87e1aa6f8a804409.pdf?index=true
    • https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_364a75fb2c7b4517a8b86454e4d76fb4.pdf?index=true
    • https://b00f38ea-0d13-4519-ab0f-1253f0d03ca0.filesusr.com/ugd/289c5e_fd11013510614e1eba51c9570a29fcfb.pdf?index=true
    • https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_d5e6c1cbeee948a093ab52b947dee975.pdf?index=true
    • https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_a70c6e23f25848aba71d49b229e7dfd2.pdf?index=true
    • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_54740aae6b324659a133a24bc8f02f15.pdf?index=true
    • https://s3.amazonaws.com/nasitevu/mokunepulexit.pdf
    • https://s3.amazonaws.com/tokatefozude/how_to_check_battery_health_android_9.pdf
    • https://s3.amazonaws.com/divexikav/fawaferubowuwof.pdf
    • https://uploads.strikinglycdn.com/files/c47a0a7a-3368-4ef5-88b6-14c5863ca0b4/xusozakojububupape.pdf
    • https://436010f1-0dd7-4950-aec0-3bdf337573e8.filesusr.com/ugd/5a4c69_f0e9c7722e204a818cb0f3f9afa7e09d.pdf?index=true
    • https://s3.amazonaws.com/geradi/is_white_fang_on_amazon_prime.pdf
    • https://992bddda-184d-467f-a815-0165b41a2208.filesusr.com/ugd/69695d_0470805857eb43b2a41353ef5c88cbad.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfd1.bin
bb13e6e5dc677264e13301eff0e04d81338110928a407de44b2f6c90e4b4adc0
pdf-font-stream PDF embedded font (sfnt) at offset 0xDFD1 5284 bytes
font_01_sfnt_off0000f1b7.bin
6018843d6abfaeb429714e4bd7d6685511d722267e0372fd8b0460affa5ee618
pdf-font-stream PDF embedded font (sfnt) at offset 0xF1B7 10424 bytes
font_02_sfnt_off00011549.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2
pdf-font-stream PDF embedded font (sfnt) at offset 0x11549 4324 bytes