Malicious PDF — malware analysis report

Static analysis result for SHA-256 afdfdf212b0ee29f…

MALICIOUS

PDF

85.3 KB Created: 2021-03-25 21:50:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 755ee14c2dd5e61ef32bec43a0ec1ac2 SHA-1: 4252bc9fce739263e9d5b4fe736384c54b46c841 SHA-256: afdfdf212b0ee29fecb7c07bc4c79588a597e36650704cbce49722530acaaa34
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files hosted on external services. One such link, https://resalured.ru/strik?utm_term=geneva+bible+vs+kjv+1611, is directly embedded in the document's text. ClamAV detection as Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 and the ML classifier output strongly indicate malicious intent, likely related to phishing or a link farm for distributing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=geneva+bible+vs+kjv+1611
    • https://jitolabifu.weebly.com/uploads/1/3/1/6/131607188/wivaw_lobezometiw.pdf
    • https://cdn.sqhk.co/kifuzopeko/jci07gd/69773106757.pdf
    • http://netolenogafa.getenjoyment.net/34857413912.pdf
    • http://jenewazajasazu.getenjoyment.net/hindware_bathroom_fittings_catalogue.pdf
    • https://cdn.sqhk.co/faroziwe/Vdjjiep/54402842863.pdf
    • https://zuxobopabure.weebly.com/uploads/1/3/4/3/134344154/tamenimotovutaba.pdf
    • https://kurupatasewa.weebly.com/uploads/1/3/5/9/135958836/ranefivikumese.pdf
    • https://cdn.sqhk.co/ragejeli/ehdN4hc/65127052660.pdf
    • https://cdn.sqhk.co/bodegife/licUPcq/3d_max_interior_design_modeling_tutorials.pdf
    • https://nelovemisero.weebly.com/uploads/1/3/4/3/134347795/mowekonosari_nurusowif_lukukadiga_nukewisa.pdf
    • http://xijulefabogi.getenjoyment.net/ethics_for_the_new_millennium.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3e3188f7-d9e9-48da-9af6-4e6760718ee0.filesusr.com/ugd/4f7562_4950ea02fbf349f69b1331f7a7dd2abe.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a3388cdc-8e81-4b1f-9c7f-c084cff8c509/do_puppies_go_into_deep_sleep.pdf
    • http://wugujub.onlinewebshop.net/mubanoduzozupenuwiv.pdf
    • https://uploads.strikinglycdn.com/files/ce4149b8-0d4f-4435-8004-b1f441bf178d/16875748799.pdf
    • https://uploads.strikinglycdn.com/files/b6609bad-ccec-4c83-aa91-ba3b9f4d7023/how_do_i_pair_my_xfinity_remote_with_my_roku_tv.pdf
    • https://uploads.strikinglycdn.com/files/809b88cb-d32e-4f05-ab08-1558b1f79941/lewegisokopufofis.pdf
    • https://uploads.strikinglycdn.com/files/5d57945d-9e37-4c1f-8e8b-ef3528a57402/napekuwonewabuzodetise.pdf
    • http://tososite.onlinewebshop.net/one_of_us_is_lying_audiobook_google_drive.pdf
    • https://uploads.strikinglycdn.com/files/1d6892de-0b6b-460f-ae4b-b5f9fc98f23f/domawesopimametolam.pdf
    • https://uploads.strikinglycdn.com/files/51a495ae-f5a7-44dc-ad7b-bf390b1013be/steelheart_brandon_sanderson_wiki.pdf
    • https://19527f6f-7821-4b33-8e58-d909ab9a203f.filesusr.com/ugd/b18fc6_5eb0f6090a5047038acb28598ebcb4b7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011086.bin
0a6e22e26a68381c162d531070f06abcf41d5b3b08f024d5432c1a65fce4fd2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11086 5160 bytes
font_01_sfnt_off0001223d.bin
9044318e2185815440f12738cb74b054e673347d4f755cf1939742ee93b9a69e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1223D 11380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.