Malicious PDF — malware analysis report

Static analysis result for SHA-256 955e3990a3b7f230…

MALICIOUS

PDF

108.5 KB Created: 2021-03-16 22:25:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: c479fd84f0e441f740755c91b318061a SHA-1: 25232ec49e9761f313a26b66457291f52f8ff6ad SHA-256: 955e3990a3b7f23070ce6dd28dfbd08cf1b1091d8f89deb0c4de5c4d4b382dd4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, identified as a "PDF_SEO_LINK_FARM" heuristic. The primary malicious URL is `https://dugedepap.ru/123?utm_term=gpx+track+report+generator`. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or SEO spam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=gpx+track+report+generator PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_267ff20702614cb0a57539a1b2f04986.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wajufifenoxuj/restaurant_inventory_sheet_example.pdfIn PDF document text
    • https://b860438a-ced3-4995-86f2-ad9a24e3f15c.filesusr.com/ugd/938eb2_024e7ecae4d240aa91d3627f2e47408c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wukevirenesu/apn_at_t_mexico_android.pdfIn PDF document text
    • https://s3.amazonaws.com/fipijife/ibm_security_qradar_siem_administration_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/gotitibekovi/inside_reading_3_answer_key_unit_8.pdfIn PDF document text
    • https://s3.amazonaws.com/zuvovoxigumuz/commandos_hinter_feindlichen_linien_mac.pdfIn PDF document text
    • https://997b2cc2-d96d-4654-b184-8a5d7ad473c0.filesusr.com/ugd/b8d08c_360d0de1be004a96a95042e41bf42eeb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xujitezu/37566506718.pdfIn PDF document text
    • https://ec2d952e-5494-46d8-b841-fee222248b17.filesusr.com/ugd/9713d5_cac6e4a052e64f23a6d638e0a3020db1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/woxotopapozokev/39887233647.pdfIn PDF document text
    • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_26089787750f49389957c9e5f6a2666e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/36811796950.pdfIn PDF document text
    • https://fa202315-5cd5-4006-9a99-7c5d4406650e.filesusr.com/ugd/61804c_2ef4311c80ce4be09598c0ee7a576e7b.pdf?index=trueIn PDF document text
    • https://3e1d1bad-f645-4ebd-ac75-469e7ff7c972.filesusr.com/ugd/e745be_9d1b7ae6dbea479da1c43a814fce7262.pdf?index=trueIn PDF document text
    • https://6ba7316d-b84b-4ccb-a32a-103c856d4013.filesusr.com/ugd/91f37e_203349e4718d4469aeb5c10fcaa9933d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/napisakaluja/mcgraw_hill_math_book_8th_grade_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/godoremitiwuja/35522438995.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000167f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x167F2 5052 bytes
SHA-256: 8dbe271e61bb5450bd9cd79f00c79884ec7844a06d8ab883c7b9bb93089e6e22
font_01_sfnt_off00017943.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17943 12220 bytes
SHA-256: f1438ff4365249d4c6257b4044c56f10114d43beb4974bfc86b7ac8232aaf3e6

Open this report in the interactive analyzer, or submit your own file for analysis.