Malicious PDF — malware analysis report

Static analysis result for SHA-256 8971591be0ae8ac9…

MALICIOUS

PDF

67.3 KB Created: 2021-06-09 00:49:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4046574e70e365d015d57a26e0b0acab SHA-1: 0f2be2421f46d812e93d21e56551edeb75f1b462 SHA-256: 8971591be0ae8ac98894932c2a47a677dfd545e6256cdadb7be64e4c86978aa0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious content. It contains a large number of external links, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://drafthe.ru/pbw?utm_term=vocabulary+workshop+level+c+pdf, which is likely used to redirect users to a malicious site. No scripts were extracted, but the PDF structure and numerous external links point towards a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=vocabulary+workshop+level+c+pdf
    • https://static.s123-cdn-static-d.com/uploads/4366957/normal_60b60104d5829.pdf
    • https://cdn-cms.f-static.net/uploads/4421224/normal_605b0ec948736.pdf
    • https://lusulabudigesa.weebly.com/uploads/1/3/2/6/132681481/luvup_votej_belova_wiwazitevujam.pdf
    • https://tofisijola.weebly.com/uploads/1/3/4/8/134863845/babd6ce1b00.pdf
    • https://cdn-cms.f-static.net/uploads/4417141/normal_60bf2e31ec17b.pdf
    • https://buvewetaki.weebly.com/uploads/1/3/0/7/130775635/8dd2bdee68f.pdf
    • https://static.s123-cdn-static-d.com/uploads/4416331/normal_60b2e5256ce54.pdf
    • https://dedemapisiwopiv.weebly.com/uploads/1/3/0/7/130775251/1928542.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nagomax.pbworks.com/w/file/fetch/144680352/bizujopenadipedaduvi.pdf
    • http://pajawazo.pbworks.com/f/mozoweduxejalevifi.pdf
    • https://uploads.strikinglycdn.com/files/d7283a05-7837-43b9-937f-5729b3f2b6f5/vedevadibabolo.pdf
    • https://uploads.strikinglycdn.com/files/ffc183fa-a605-46e3-9c5d-fab109c8218f/ford_ranger_service_costs_uk.pdf
    • https://uploads.strikinglycdn.com/files/20238c09-11c6-485e-9992-711534e4df5f/tibetafinik.pdf
    • https://uploads.strikinglycdn.com/files/360b84bc-bace-4390-83a4-ef282c337241/renalib.pdf
    • https://uploads.strikinglycdn.com/files/a766101c-5565-4e86-9924-9c852e8e7a82/how_many_calories_in_fresh_veg_juice.pdf
    • https://uploads.strikinglycdn.com/files/27501d3b-ec89-43c5-b9d2-e0657d5ddf6c/ratio_proportion_word_problems_worksheet_answer_key.pdf
    • https://uploads.strikinglycdn.com/files/f2924711-7f6d-42e1-b52b-ac24bdf89af1/80749502658.pdf
    • https://uploads.strikinglycdn.com/files/1e791fa4-6058-4ede-b276-6899ea70c9cd/81632462293.pdf
    • https://uploads.strikinglycdn.com/files/49a03f6e-3674-4e60-a4b5-5ce5ab586aa7/6099811590.pdf
    • https://uploads.strikinglycdn.com/files/cf7b0036-ed41-40d9-a8fe-48a6aea5e6f7/cinematography_theory_and_practice_image_making_for_cinematographers_and_directors_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd10.bin
a4811be5d29975df52d54a1921d628af7ff2e248c084272f5a1c57e0fead0d2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCD10 5668 bytes
font_01_sfnt_off0000e06b.bin
bb25f5fba76d1948748504ee64f4af4e5b9a8336f4f7f8e30a652ccf5ff10148		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE06B 9288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.