Malicious PDF — malware analysis report

Static analysis result for SHA-256 870cd4da2490834b…

MALICIOUS

PDF

72.6 KB Created: 2021-06-09 20:42:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 338410fc3cfbee165cce22fc1b14f40e SHA-1: c970b3ad6376b18a172b454404a4e4dc67214a68 SHA-256: 870cd4da2490834b4d3483f74321f68cf34189c66d6d081bb1ade58534d5e41d
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including PDF_SEO_LINK_FARM and ML_NYX_PDF_MALICIOUS, and detected by ClamAV as Pdf.Phishing.Trojan. The presence of numerous external links, including one to 'crewmak.ru', suggests a link farm or phishing attempt. Although no scripts were explicitly extracted, the PDF structure and heuristic firings indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=compress+size+of+mp4+video+online+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454042/normal_604d79a5a0240.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365621/normal_60413ac4ce79d.pdfIn PDF document text
    • https://gavuzolarot.weebly.com/uploads/1/3/4/4/134458525/ladab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369512/normal_603fda8fd996e.pdfIn PDF document text
    • https://joxobupapi.weebly.com/uploads/1/3/1/4/131454586/dazetij_zovegitu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370304/normal_5ff004769eb4a.pdfIn PDF document text
    • https://zepukuliro.weebly.com/uploads/1/3/5/9/135964459/pogatovemekub_xufadidin_mikimafavam.pdfIn PDF document text
    • https://pofisuxix.weebly.com/uploads/1/3/4/0/134016862/wesorosiv-foxumokufa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4458137/normal_5fed6a13761ad.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455681/normal_5fcf7ef86bf28.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/77d221f4-c018-402f-bab0-8f495fddc853/rusetuvasujinabowonisid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/884ded57-6658-4780-86e9-fe539d033204/79763745332.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abd21fea-6b44-4671-bb49-7c18b255ec8b/five_different_types_of_fibres.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1feb58b0-3c8a-4d7a-8ba6-3f5f288f3090/what_type_of_bonding_does_sicl4_have.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99f605fa-43a0-45e4-bb95-86060293586f/xategazudegazifuguwutepo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8f26549-ef95-4e74-8d50-3ae8fd8d7afc/10456446389.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d69a25d0-c55a-43dc-8fd4-a5c065d60863/schlage_century_touch_electronic_door_lock_deadbolt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de539e6b-a83a-425a-bb16-a84c7f85b10f/kexabaralefejufox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1497dac0-3ffd-456b-a6be-89904f4a65a7/79011523224.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01b212e5-f29d-45e9-a614-7d9cb13ac518/what_milk_should_i_use_for_smoothies.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF79 5080 bytes
SHA-256: 1ee1dbea38f3a6d7552b1ff426fc0a61d0e659bd786160ea197567def2cf5a5a
font_01_sfnt_off0000f0bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0BF 10620 bytes
SHA-256: e3f3072286a5ae9570ef1d1d1534d6ad2a296215754f1264660a40189b29856c

Open this report in the interactive analyzer, or submit your own file for analysis.