Malicious PDF — malware analysis report

Static analysis result for SHA-256 a10c85ca6a3ead46…

MALICIOUS

PDF

72.0 KB Created: 2021-04-04 18:03:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ed1b4920311b042e628eb2dbf42e6ab SHA-1: dcafc262cd683fcb1750a6abb4a7f16418463b6f SHA-256: a10c85ca6a3ead465e14b0d6321a8c1b35e28c6c05b538b78ea01e376119a790
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a PDF SEO link farm. The primary malicious URL, 'https://resalured.ru/123?utm_term=annex+14+aerodromes+pdf', suggests a phishing or malicious redirection attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate it's designed to drive traffic to external, potentially malicious, sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=annex+14+aerodromes+pdf
    • https://cdn.sqhk.co/wubofuse/dnhazDD/pekaxumat.pdf
    • https://cdn.sqhk.co/gimowiboxero/6uhfhgG/photo_editor_app_free_windows.pdf
    • http://artrosil.xyz/kofivogonosipulawobisif5yrn.pdf
    • http://info-pages.ru/john_the_ripper_command_line_examples4gdyh.pdf
    • http://jezetufo.iblogger.org/18821604292.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/jesidofefe/74598383547.pdf
    • https://df9240ce-57b4-430e-a582-521170ca5232.filesusr.com/ugd/10b03a_4428547376e64a3ea13cef975634a55e.pdf?index=true
    • http://lavodusepigixu.rf.gd/17477520831.pdf
    • https://ad858f6a-7bbb-416d-9365-e04d7986ed9b.filesusr.com/ugd/3c9ac1_8f97afe87dbe4410ba06d4e92a52e9c9.pdf?index=true
    • https://45f0f727-c607-4398-b3b7-8b42e23b21b2.filesusr.com/ugd/0a84ca_2b37cac8b99c4cc3908bd9b01e37af45.pdf?index=true
    • https://49550882-97ce-44db-a38b-6e383bb81149.filesusr.com/ugd/062c90_333f795cb02449748c93b48e7a04ba0b.pdf?index=true
    • https://ce2645ba-e89a-43d5-afff-5c0150757291.filesusr.com/ugd/c63dba_fecd0e8c5a1747bd8afdb588a043454e.pdf?index=true
    • https://s3.amazonaws.com/pipaneku/38948456103.pdf
    • http://wovovaj.rf.gd/how_does_google_search_engine_work.pdf
    • https://d56a38bf-d62e-453c-9b5b-5b2fe88aea46.filesusr.com/ugd/359e64_abac19c7cf4642db860149581359c0bd.pdf?index=true
    • https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_674aff8bddbd4c818905350a11532a6d.pdf?index=true
    • https://ffcd7f67-9b43-45c2-8e44-b15cca9583b8.filesusr.com/ugd/48bf55_bb7ad3ed2c374e879a23fceade694d04.pdf?index=true
    • http://taruligewonuna.rf.gd/bababiretosif.pdf
    • https://s3.amazonaws.com/wibedubosateg/medemilivukokilotijubok.pdf
    • https://492f55f4-3442-4b37-b17e-39d9f2f0ae8a.filesusr.com/ugd/7dfe85_911ba79faaa547ee827232cfd3490473.pdf?index=true
    • https://s3.amazonaws.com/punurum/97238031742.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d17e.bin
ebeafdd7f452d2260a03c4b72fde3209091c84bbc0277d0b74c367543826c368		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD17E 5012 bytes
font_01_sfnt_off0000e26c.bin
0015c2eaf96f7cb839da904ccbb58fbd9f3adb32544c2f5a1953b1e32f08e761		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE26C 10096 bytes
font_02_sfnt_off000104f7.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104F7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.