Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b4f1285b41ccf55…

MALICIOUS

PDF

81.1 KB Created: 2021-03-23 03:37:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5a2fc1846e41ce8613d72ec28c2227a SHA-1: dfe1cfbca0ed5b01b10b53f386ab37b5d426ad3d SHA-256: 8b4f1285b41ccf55e508b0dfd3467be60c4a6bedae467edcb1ba827629579e13
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to drive traffic to various websites. One of the primary external URLs is 'https://dafemum.ru/wix?keyword=nyc+doe+district+79', which is likely part of a phishing or malware distribution scheme. The ClamAV detection and ML classifier further support the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=nyc+doe+district+79
    • https://cdn.sqhk.co/wixakulu/iczhbhi/81669715315.pdf
    • http://meblik.su/where_is_the_reset_button_on_lg_refrigeratorp2g01.pdf
    • https://cdn.sqhk.co/rutisifelom/hjtjf9Y/56123367730.pdf
    • https://cdn.sqhk.co/dibirolinu/jho7z6i/diep._io_necromancer_controls.pdf
    • http://rankingcoach-apps.com/795956141249eckj.pdf
    • https://cdn.sqhk.co/fexilejedit/tixsgh5/wovukebibodonixis.pdf
    • http://brettlockhart.com/vadereridulpje7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e0ce5cf5-83c0-437f-9a84-8ed31e9d07e7/92350694690.pdf
    • https://uploads.strikinglycdn.com/files/6ea52577-d897-418f-83c6-a3006e0d98e3/78177125610.pdf
    • https://uploads.strikinglycdn.com/files/3d8e5eac-d7d1-4897-862e-53548d7c5db0/23018343521.pdf
    • https://77a48bbd-706a-45f8-a225-ac1cc02029d7.filesusr.com/ugd/3be48b_ee141f626f4a490fb43590c96d197196.pdf?index=true
    • https://aa4c2489-c93b-4667-afab-104bf5323bad.filesusr.com/ugd/8b49c6_019b28b64f7949b5b72576256f7f4c94.pdf?index=true
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_2913b6c1fb6e45fc96ef41956d87dc3a.pdf?index=true
    • https://9d3edb37-11ce-4d87-b861-4f8d850d55a0.filesusr.com/ugd/0d2aa0_4c8cee14c45b4c8192f85b7268b26951.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c9ee2621-eef2-443d-b0da-77351391c43c/60619178328.pdf
    • https://16012499-1299-48b0-8cdd-5f23a7749958.filesusr.com/ugd/fafc38_13f8e5ccd58548e8a89fec19df971dc2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3e40618a-791d-4fbb-aae6-880e441e60e4/futozipudibagokizagufokip.pdf
    • https://b913155d-2712-4fd4-bcc6-651970a8c456.filesusr.com/ugd/e39924_2f7d568a1f5f4ae9bbafed0e5a5e383e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/11ebfcd7-05ef-4dbf-a5bd-34640980128c/pc_2020_games.pdf
    • https://uploads.strikinglycdn.com/files/e2240e37-c2c8-49f7-8613-d87888cd37bb/what_kind_of_cheese_sauce_does_taco_bell_use.pdf
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_d5a9c234533c431ca7bcd71da57dba6a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dc21ad80-68d2-4fdc-9ef0-d57be4762465/how_much_does_it_cost_to_replace_septic_tank_and_leach_field.pdf
    • https://3c3713de-992c-4571-92b4-00afcb8cb2c1.filesusr.com/ugd/9dbdb2_08de3a3f64024b72b65e79c9763309eb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001010f.bin
794472484bb871c15db96e0c2bde9453f88d9203c165d95232e5d16262c802b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1010F 4996 bytes
font_01_sfnt_off0001122e.bin
2ccb80938b2bdb5ed6e649d8fa6c222635c5bc1326afd8da77118aaf5d0e2deb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1122E 10808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.