Malicious PDF — malware analysis report

Static analysis result for SHA-256 a508efc062417359…

MALICIOUS

PDF

74.2 KB Created: 2021-03-21 10:33:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: 72018c6fd533fd52a45f4ea5fd60fcb8 SHA-1: 0ef3992d305310b02e8b975e192e93814c2279ab SHA-256: a508efc062417359e3f7e2f856efd9bc1f8aeda2d86fa3d6f67febd6e1af5cb2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common technique for link farming or directing users to malicious sites. One prominent URL, 'https://fokemale.ru/strik?utm_term=2012+chevy+impala+ltz+review', appears to be the primary lure. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing or trojan variant. The presence of embedded links and the detection results strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=2012+chevy+impala+ltz+review PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4406223/normal_602b700f7f936.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496389/normal_6010a3641cf58.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379048/normal_5fd84b481319c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369796/normal_604b18d39a81e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369514/normal_5fff93c51a42f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408588/normal_5ffa278f7bcee.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456119/normal_5fca98e1e1ede.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456134/normal_603b1bcb9f8e8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/32c547e2-c565-4881-8bec-8c1ae86fc44f/fupapojakigiwalekog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0905b381-e6ab-4505-88fa-d8bed1ccec15/18667353705.pdfIn PDF document text
    • https://755d026c-fd58-4633-9ca9-8af24261f473.filesusr.com/ugd/4622eb_cbec412a237c425aba3133598cb9f0ab.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/retobifulipo/kolkata_bengali_movies_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/79142070-43d4-4b4e-b0d8-6e7e29531aca/ice_breakers_candy_cane_gum.pdfIn PDF document text
    • https://s3.amazonaws.com/wujixus/vukisudixuvosud.pdfIn PDF document text
    • https://s3.amazonaws.com/serogajugomiji/the_5th_wave_second_wave.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7ccd897-f264-4f06-bb63-cbe81d641ac8/96436165134.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ae220c2-ee72-4909-8373-63ffd893b09b/kikonuxat.pdfIn PDF document text
    • https://s3.amazonaws.com/xowasosuf/philips_respironics_system_one_auto_cpap_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c53d62ba-28da-4181-9946-721dd62d9093/jamey_aebersold_volume_54_maiden_voyage.pdfIn PDF document text
    • https://8d5bcf17-53f2-4f21-b585-7a27aef14131.filesusr.com/ugd/7baf93_46b299fba8da424196bebd408d2e9167.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e37d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE37D 5528 bytes
SHA-256: 82215f7dab50506ba99d9ff91dae6c9e74f8761283085a3d68eff5e7d78fa946
font_01_sfnt_off0000f648.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF648 10800 bytes
SHA-256: cdd99a1168aff21c3ca19c72ace84cd9411d68e2000834ab4a82f0941a517c2f

Open this report in the interactive analyzer, or submit your own file for analysis.