Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad2ff0535a7ba3c2…

MALICIOUS

PDF

79.3 KB Created: 2021-05-20 21:55:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 007fec895fa32c4bb24f12bf5a7b8c43 SHA-1: 55be0dab2e2a7b9320db03130daacc716ccf21a5 SHA-256: ad2ff0535a7ba3c2f952f7a73af633f12403e151fe0c6adc8e2120ea6ff54107
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to PDFs, suggesting a link farm or redirection mechanism. The primary malicious URL, 'https://midufefew.ru/strik?utm_term=how+to+thread+a+brother+xr-65+sewing+machine', is likely used to deliver a secondary payload or redirect the user to a phishing site, disguised as a sewing machine manual search result.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+to+thread+a+brother+xr-65+sewing+machine
    • https://cdn-cms.f-static.net/uploads/4392462/normal_60554efcabd77.pdf
    • https://nivozigagu.weebly.com/uploads/1/3/4/4/134439663/9519234.pdf
    • https://juderesovabivov.weebly.com/uploads/1/3/4/6/134680251/xikimerorowe_tuligidesus.pdf
    • https://cdn-cms.f-static.net/uploads/4470685/normal_602ee05e94627.pdf
    • https://sedovabopidixo.weebly.com/uploads/1/3/0/8/130813108/xixunibajij-pajidev-nofufurif-tugodinas.pdf
    • https://rimovume.weebly.com/uploads/1/3/1/4/131452953/vonubokinepeditegu.pdf
    • https://ginadilu.weebly.com/uploads/1/3/4/7/134768391/rujumenenuxove.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/da60cded-1be8-46f4-91ae-0c23ec7884d6/8951699168.pdf
    • https://uploads.strikinglycdn.com/files/93951969-1b61-4368-b6f5-36f02fdf3a7a/best_blues_guitar_course_online.pdf
    • https://uploads.strikinglycdn.com/files/b6922d28-e3f3-48bf-bc4d-a522e4899000/modewiwos.pdf
    • https://uploads.strikinglycdn.com/files/82cbb377-24fe-4587-9329-5699a727e650/bedivugalel.pdf
    • https://uploads.strikinglycdn.com/files/8192033a-ee05-45c1-acb1-fcef568c2a40/69293934265.pdf
    • https://uploads.strikinglycdn.com/files/57eeecd2-ea40-4f70-9944-964ac6008478/william_blake_the_lamb_questions.pdf
    • https://uploads.strikinglycdn.com/files/7106a73f-dd09-4793-a204-58f109a4c3a1/zojerume.pdf
    • https://uploads.strikinglycdn.com/files/99ba7caa-a66a-4f5c-a9f0-a7959550c115/kidafufovuveritufadekowon.pdf
    • https://uploads.strikinglycdn.com/files/d5ee4d73-fd17-4b2a-a41f-7a30189c72b0/11387534232.pdf
    • https://uploads.strikinglycdn.com/files/9896ea90-4201-4534-9c2a-9234dc5a2ef1/97895365355.pdf
    • https://uploads.strikinglycdn.com/files/1309ceec-945e-41c0-854a-5c95d887e83f/cant_connect_to_jbl_flip_3.pdf
    • https://uploads.strikinglycdn.com/files/88a2898a-c863-459d-8599-280f7a66ef4a/90848346754.pdf
    • https://uploads.strikinglycdn.com/files/61612487-3d00-4b67-a9f7-b997ff2480cc/82074089426.pdf
    • https://uploads.strikinglycdn.com/files/dd31a221-5f7e-4a9c-97d5-52568acc33c8/sivokolo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e965.bin
127ac8595726b6da457fd77f780754a44a97550c474d2a3c56799d1b210d2f8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE965 5680 bytes
font_01_sfnt_off0000fca1.bin
f8799a3329e1c5df1864d5e762b011f1bdae0ca4e4a33f565254abc5e3fa3aad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA1 10836 bytes
font_02_sfnt_off0001217d.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1217D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.