Malicious PDF — malware analysis report

Static analysis result for SHA-256 9812c55d1eee6a4b…

MALICIOUS

PDF

74.8 KB Created: 2021-03-17 20:21:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9607502a420fff1be8672467b8eccd88 SHA-1: a95161be238339abcdb517fd998876f2846d2d45 SHA-256: 9812c55d1eee6a4bcbbecec79556a7a0170f1b9a5fafadf69267c0adb3cde303
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or spam campaign. It contains numerous external links, with a primary suspicious URL pointing to 'dafemum.ru'. The document body, though heavily obfuscated, suggests a lure related to water heater repair, likely to drive traffic to these malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=how+to+replace+bottom+element+in+water+heater
    • https://cdn.sqhk.co/wepurodapike/hjMjejj/diners_club_corporate_card_rewards.pdf
    • http://wifisef.medianewsonline.com/71762384609.pdf
    • https://cdn-cms.f-static.net/uploads/4375355/normal_5fe79fd96cea9.pdf
    • https://static.s123-cdn-static.com/uploads/4410020/normal_5fc68b7c216e5.pdf
    • https://cdn-cms.f-static.net/uploads/4385887/normal_60443ee75b848.pdf
    • https://cdn-cms.f-static.net/uploads/4407314/normal_604c99750f696.pdf
    • https://static.s123-cdn-static.com/uploads/4369328/normal_5feb35e65d789.pdf
    • https://cdn.sqhk.co/mulepava/geufwja/rupovenog.pdf
    • http://suberubepuparo.getenjoyment.net/adachi_to_shimamura_light_novel.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_c21ccb81392742fb9b29def635ec1467.pdf?index=true
    • https://s3.amazonaws.com/robumuduluwise/35807414497.pdf
    • https://ff999131-262c-4f46-aa1e-84c50d3d9e43.filesusr.com/ugd/a474dd_ee025e0ecde741f19fce32a67c4609ec.pdf?index=true
    • https://03df18d0-0a94-4077-8b44-1f3cf8b7c870.filesusr.com/ugd/23a6c3_241e984e2eab4fe9a87257029548caec.pdf?index=true
    • https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_280cf38913194a5fb7b6c45ce6765a75.pdf?index=true
    • https://c69a8150-bb1e-4c46-878b-fc1622391bd7.filesusr.com/ugd/cf91d6_f34ba458313341ffbcadaf5328dba8d4.pdf?index=true
    • https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_731d3ca689944453a672421c7f92b1d7.pdf?index=true
    • https://s3.amazonaws.com/wegugus/35551490076.pdf
    • https://s3.amazonaws.com/jifesu/69301170301.pdf
    • https://fccd5518-64e1-462d-9dbe-8d8d8a19ca7a.filesusr.com/ugd/eb005d_2a741b19584a4a66bdf2d2e7732a350e.pdf?index=true
    • https://s3.amazonaws.com/nolarifaforuxop/chambal_fertilizers_annual_report_2017-_18.pdf
    • http://taberadajip.atwebpages.com/vonajavaturobedoku.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e74d.bin
a1e892f00099cb4109faf36c7b58b59462e46491e2fb2af4df4a63ad329e8784		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE74D 5188 bytes
font_01_sfnt_off0000f8ce.bin
a6a0f0f9990029ada594851f4ef8cf74bb2e284a85ba2757da516fa1a1f52dad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8CE 10800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.