Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad01e7fac4d3a6a4…

MALICIOUS

PDF

79.7 KB Created: 2021-03-23 11:28:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd35f070ce2851c8241c42b9e6dcbc56 SHA-1: 1cb12915ba22127351da6009bc13b19bcd7b23c9 SHA-256: ad01e7fac4d3a6a44f1165652c58d0ab0c6804deb457328502afb0d20dc5e109
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL pointing to 'dafemum.ru' which is flagged as suspicious. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or a mechanism for distributing malicious content. ClamAV detection and ML classification strongly indicate maliciousness, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=section+11.2+speed+and+velocity+answers
    • http://tanuwoxomasosog.22web.org/37495932716.pdf
    • https://burusezal.weebly.com/uploads/1/3/5/3/135306482/20a846929d1c.pdf
    • https://mazakodavowur.weebly.com/uploads/1/3/4/3/134335882/4faf387f4.pdf
    • https://dodapufil.weebly.com/uploads/1/3/0/8/130813701/tozagugo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xuzed/spider_man_ps4_pc_game_free.pdf
    • https://uploads.strikinglycdn.com/files/8ce12635-b697-4e2d-b05b-c2aaa3916b40/zuxoxamenenaxilo.pdf
    • https://s3.amazonaws.com/nazekisigiduz/videoder_14._3_4_apk.pdf
    • https://86a6be6f-1c3f-48a2-98e5-8a654ddc1212.filesusr.com/ugd/027f51_481e8b29b19a42c78624fe7ae40c0623.pdf?index=true
    • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_663fbc5a905a4b4ba9e1bc9fee990b2c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5cd46d12-2076-4229-826d-a02932c9a877/89372654971.pdf
    • http://xenuduximowub.epizy.com/bye_bye_blackbird_alto_sax_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/9cebd1c7-2d0f-4609-9d67-5f12b8422790/behringer_xenyx_302usb_mixer_review.pdf
    • https://uploads.strikinglycdn.com/files/ff257200-b27d-46ed-bc91-00e91ac7404c/84602123570.pdf
    • https://uploads.strikinglycdn.com/files/784b9002-6dc2-4c32-815b-5719884550e3/8884441590.pdf
    • https://s3.amazonaws.com/mokamoba/57834002760.pdf
    • https://80c93ba6-74df-4afb-9852-3a83eaba20e3.filesusr.com/ugd/4cf28d_cc1ad796a8b1484a947ef68c0b76aec2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ac11e273-83ce-4003-9705-d0fb44c5c572/7_day_meal_plan_to_lose_weight_free.pdf
    • http://kevikawimal.epizy.com/django_template_language_if_else.pdf
    • https://uploads.strikinglycdn.com/files/36d313fa-6248-421e-8abb-53ab92272ac1/2387303536.pdf
    • https://uploads.strikinglycdn.com/files/5e1cffa0-01a5-4b8f-bdb0-0e234a557fc5/dyson_dc59_filter_change.pdf
    • https://uploads.strikinglycdn.com/files/cb0efca5-dad8-42d7-8a4a-1a67269ec933/how_to_set_woods_outdoor_lighting_timer.pdf
    • https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_cfefc8d5521d4066b987b32368ab8892.pdf?index=true
    • http://dofumuligo.rf.gd/63891859907.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f86f.bin
80ccfba6498a7603fad5c11e3da31aa147a0322372d4e155ca7dd995710cc9ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF86F 5640 bytes
font_01_sfnt_off00010bdf.bin
632b6cc573bf906513a450f8188555eab22b2908655d843953379d27f222646d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BDF 11008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.