Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd2959c3515c241e…

MALICIOUS

PDF

81.7 KB Created: 2021-03-15 08:35:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2e381a13809eb6733ac6fb52a43a6f55 SHA-1: 1ea14509a0efc375285e2d0dcb1957330613e785 SHA-256: bd2959c3515c241ee4f7e74818ba4266aff9333d5d7a4d3091f5b69feb8f8bb8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to PDF files with numeric or generic slugs, indicating a link farm designed to manipulate search engine results. One primary URL, 'https://fokemale.ru/strik?utm_term=how+to+write+an+award+presentation+speech', suggests a phishing or scam attempt. The ML classifier and ClamAV detection strongly indicate maliciousness, likely related to phishing or a trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=how+to+write+an+award+presentation+speech
    • https://static.s123-cdn-static.com/uploads/4461766/normal_60023b8e6cfbe.pdf
    • https://mubajodopiwal.weebly.com/uploads/1/3/1/4/131454521/bubajavudokawozofof.pdf
    • https://cdn-cms.f-static.net/uploads/4384639/normal_601dbfcc468e6.pdf
    • https://vebavorosufate.weebly.com/uploads/1/3/4/7/134742301/243888.pdf
    • https://cdn-cms.f-static.net/uploads/4371023/normal_601d64cf17300.pdf
    • https://legadiduzavof.weebly.com/uploads/1/3/2/6/132681829/19048.pdf
    • https://static.s123-cdn-static.com/uploads/4450864/normal_5fe46fd57c0c0.pdf
    • https://static.s123-cdn-static.com/uploads/4405179/normal_5fe40d4b7ac14.pdf
    • https://paxazojip.weebly.com/uploads/1/3/0/8/130873894/3456105.pdf
    • https://xubejuvanexog.weebly.com/uploads/1/3/5/3/135311054/zasowaxe.pdf
    • https://zajilonuxiwez.weebly.com/uploads/1/3/4/8/134871265/kodugedapofunuvukifo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bbf54c9c-07ad-4976-a991-2bd3592efbee/sukefikasus.pdf
    • https://uploads.strikinglycdn.com/files/804da3da-c5e7-4799-9695-1d5e861f2847/baby_gap_toddler_girl_underwear.pdf
    • https://uploads.strikinglycdn.com/files/a8d593c5-c635-48c2-8357-3cd11d73e5cb/fill_in_missing_numbers_on_100_chart.pdf
    • https://uploads.strikinglycdn.com/files/6c8ede87-54ef-4fec-bdae-e214b9fd5308/what_is_bug_in_computer_terminology.pdf
    • https://uploads.strikinglycdn.com/files/2835cb5e-dab8-447c-b536-19c0536d7d0b/98827897780.pdf
    • https://uploads.strikinglycdn.com/files/965ef1e3-2ae8-4e6b-84de-9062ed827c80/how_to_program_genie_directv_remote_to_vizio_tv.pdf
    • https://uploads.strikinglycdn.com/files/f274fe8b-d95c-4313-afb0-19fe12eace18/danby_kegerator_dkc645bls_parts.pdf
    • https://uploads.strikinglycdn.com/files/cfaa3945-d402-449a-9ef7-14842f489b68/cliburn_plays_basketball_defense.pdf
    • https://uploads.strikinglycdn.com/files/56783926-fdb9-4353-8349-e1ee68d6a6b1/how_to_become_a_health_and_safety_officer_ireland.pdf
    • https://uploads.strikinglycdn.com/files/f12e245c-516d-42fa-8630-650c52717d2f/best_eyepieces_for_celestron_nexstar_130_slt.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000103b6.bin
376fc5fce8b7879276c918953a6baff2540f07f4a481a3aeae0dc22720dc262a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103B6 5184 bytes
font_01_sfnt_off0001155d.bin
2f8e06d3fd933126e7e0fa4596d9047e94e77ce77943359a12c2d1eea28af3e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1155D 10596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.