Malicious PDF — malware analysis report

Static analysis result for SHA-256 adf5a7c56d292d04…

MALICIOUS

PDF

71.8 KB Created: 2021-03-30 10:59:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f5600b083246d5e5bb9ba2ace2c03ab2 SHA-1: 8ab93ab22b0fda442015296ef30bd2f04c35ea3d SHA-256: adf5a7c56d292d04ceaf3a4f79f82fb82488bee0818032616d4c00cc527e59c6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are structured as a link farm to generate SEO traffic. One of the primary links, 'https://druttle.ru/award?keyword=bhagavad+gita+as+it+is+pdf+in+tamil', suggests a phishing or scam attempt disguised as a search result. The ClamAV detection and ML classifier further indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=bhagavad+gita+as+it+is+pdf+in+tamil
    • http://janipuwibir.mywebcommunity.org/40248807086.pdf
    • http://gexopidikimo.mygamesonline.org/12718537578.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/niporofez/91471298929.pdf
    • https://s3.amazonaws.com/sisaxu/why_is_the_era_called_age_of_reason.pdf
    • https://uploads.strikinglycdn.com/files/514f008c-3aee-4dd1-ae6f-ba4dc7cff153/ejercicios_de_verbos_irregulares_en_espaol.pdf
    • https://69868269-04aa-4a0d-8379-1371762fd556.filesusr.com/ugd/d8beff_dc539c3fd42445639619f229d8732695.pdf?index=true
    • https://e05653fc-386e-4c8b-889d-738aee72c63e.filesusr.com/ugd/62421a_49bdd44bd5b8408d815a20e7983e4948.pdf?index=true
    • http://ridupokibi.epizy.com/broadsheet_perth_pizza.pdf
    • https://s3.amazonaws.com/pobixedele/gluconato_de_clcio_bula.pdf
    • http://diladamosune.rf.gd/best_reader_for_apple_ipad.pdf
    • https://s3.amazonaws.com/nisiwanolom/westbury_high_school_dress_code.pdf
    • http://bosagiriwamokin.onlinewebshop.net/amenaza_concepto.pdf
    • http://zedovapovakodev.rf.gd/kuxawimawa.pdf
    • http://wagamaxoja.rf.gd/high_school_worksheet_answers_dimensional_analysis_worksheet.pdf
    • http://jubadoloje.epizy.com/who_is_the_most_beautiful_kpop_girl_group.pdf
    • https://uploads.strikinglycdn.com/files/ef60f742-ca77-4180-bde7-52b5ec0aec54/how_much_does_a_honda_b1_service_cost.pdf
    • https://uploads.strikinglycdn.com/files/901c30b3-2102-45f0-a0c0-042cc4e9bbf8/salary_of_amazon_software_development_engineer.pdf
    • https://uploads.strikinglycdn.com/files/792c2895-e0c2-4cf2-a704-cbb513ea8968/71573441260.pdf
    • https://2080fafa-2491-4ac3-8118-a138f33bff34.filesusr.com/ugd/822ecd_24db3b1055674038b062594b89f69e57.pdf?index=true
    • http://lizuratudesaxop.epizy.com/la_campanella_piano_sheet_music_easy.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d68e.bin
c579eab407722d8dec9c6fc6aaccaa12e953002bbe3b745985b02765c28527da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD68E 5468 bytes
font_01_sfnt_off0000e918.bin
751a2a2a951e82d29d4f94503041b9a1a70effbc785a7ecdfcd8f4c017ff84ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE918 11620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.