Malicious PDF — malware analysis report

Static analysis result for SHA-256 a05a4a644616f348…

MALICIOUS

PDF

79.7 KB Created: 2021-05-13 18:43:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 8a1dedec2da1b2b0bb1f61e9a8d8da4d SHA-1: 61fcc5ac6843a98b90c38d6478728fe3877ad37a SHA-256: a05a4a644616f348a0745d477b95e0640239b6f4e3bef38b95223227793664c3
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to disposable hosting, suggesting a link farm or phishing operation. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URLs, particularly the one leading to 'druttle.ru', are likely part of a phishing or scam campaign designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=jerry+bob%2527s+breakfast+menu+prices PDF link annotation
    • http://tokio-2020.fun/wosomop93f81.pdfIn PDF document text
    • http://helplnstagramcontact5087423.com/fobuwitaterumisejarinewipfo8lp.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454304/normal_6056fd48f1f88.pdfIn PDF document text
    • http://storeyou.store/rejijawidivalugivilaf6e4qx.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373992/normal_5ff5fdb996aaf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413567/normal_602fa3acbf76e.pdfIn PDF document text
    • http://parralax.net/acer_iconia_tab_a200_update_android_4.1e8hr6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/2ce14354-e4e7-4874-a555-ea162ea67f67/xisalulefe.pdfIn PDF document text
    • https://cf336f9a-6a79-4542-9269-5b62d6eb69dd.filesusr.com/ugd/1daf83_71480614fb714416badc2037ccc900f2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/06ba5a7b-7814-4317-a303-ea5ab9bd5152/modavufunotinobalonipemo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbce4a6d-fd9f-4c68-885e-9b9f07dd825c/vivekepavalerokire.pdfIn PDF document text
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_fa6a91425ce6402b9aa570f4fe89c87a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4b6501c-e96f-4947-bf60-5f2dfc079173/polaroid_sx_70_sonar_autofocus_manual.pdfIn PDF document text
    • https://569e8712-2873-4b93-a654-ea71b6b809e3.filesusr.com/ugd/345929_ac876a0beb7c47068340c88d7010241b.pdf?index=trueIn PDF document text
    • https://9f349447-249b-4747-956a-316fe86e371b.filesusr.com/ugd/d2b720_e2d1657aecae49e885bade97908c1b59.pdf?index=trueIn PDF document text
    • https://f1e11ea9-a931-46ad-af30-391325c877dd.filesusr.com/ugd/423518_3d7da7c9f84441208f1673e064fa8199.pdf?index=trueIn PDF document text
    • https://d525ee04-2a40-494f-8ba9-fee52f7b18ee.filesusr.com/ugd/8b8e24_7f8099c4c06843c1a015f511426421e7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7939ee37-d02a-477d-8c9d-5d01e8fce515/bissell_proheat_2x_revolution_max_professional_carpet_cleaner_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06ab7327-5e43-4c04-ae3f-4ee3f1c8ee9f/lowrance_elite_5_chirp_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8998f9c4-44e5-4687-b440-71a752dfb136/zefuwepesetefupatodet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e45ba04-ee1f-4476-aa21-a61776f1ec87/wadezo.pdfIn PDF document text
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_55ec495870ed49fe8059b1844bd20f33.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/89082e5a-c1a2-4a0d-8707-424c9312c059/35779712546.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eac5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAC5 5340 bytes
SHA-256: de3053ecc96823add08d30a0c9f017bba2bc7af92b6eb2d9cc96d3f436b3bcbb
font_01_sfnt_off0000fcec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCEC 11212 bytes
SHA-256: 24a30dbe579fbe52a8785b4c40e02fcd210be988f5480cc669d8dfb3ec60a786
font_02_sfnt_off00012319.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12319 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.