Malicious PDF — malware analysis report

Static analysis result for SHA-256 c08f1932d8ef4896…

MALICIOUS

PDF

77.5 KB Created: 2021-03-28 21:17:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93f3b10f827d590381839d3ee0262015 SHA-1: 33f6444d1003a76a23d4f99f13005a494bf745a7 SHA-256: c08f1932d8ef4896d8f98d2dba53c9fb3f512a353150f98f0de0c3a7d93e8516
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external URIs points to a suspicious domain, 'druttle.ru'. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution via these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=campylobacter+jejuni+guillain+barre+pdf
    • http://piriveva.scienceontheweb.net/zotoxar.pdf
    • https://cdn-cms.f-static.net/uploads/4407102/normal_6026ac1a6627b.pdf
    • https://cdn-cms.f-static.net/uploads/4378386/normal_6039042c5c107.pdf
    • http://radelewudawa.iblogger.org/arthur_c_clarke_the_city_and_the_stars.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7e70056c-c2aa-4e53-98c5-50750123c107.filesusr.com/ugd/f8ae5d_d939f5ffb85d40f4a4ecb4b72570ef0e.pdf?index=true
    • https://s3.amazonaws.com/wusone/banco_falabella_cts_formato_2018.pdf
    • https://s3.amazonaws.com/nademopor/bujusotosogalatisakiwaki.pdf
    • https://s3.amazonaws.com/potofaw/luzesimetigapugugimalagul.pdf
    • http://dusujelad.rf.gd/60217933611.pdf
    • https://979cd01f-16ea-4d2c-b189-234964c95597.filesusr.com/ugd/d4c4cf_83d95b41cf9e4419b26e317c70b2c6c8.pdf?index=true
    • http://nokejufesuw.atwebpages.com/junkers_cerastar_bedienungsanleitung.pdf
    • https://s3.amazonaws.com/lezerawe/what_is_the_enoch_pratt_free_library.pdf
    • https://s3.amazonaws.com/goviwigax/rugediripasotisunot.pdf
    • http://toxunef.rf.gd/bose_headphones_comfort_35_manual.pdf
    • https://eb40363d-1d1f-4170-a897-f23f0f433116.filesusr.com/ugd/2a1429_069acfbfecf049f0a4a5cd0d42cece8e.pdf?index=true
    • https://s3.amazonaws.com/pozokimepe/lagu_alif_satar_lelaki_seperti_aku.pdf
    • http://dafukip.myartsonline.com/types_of_anaemia_in_pregnancy.pdf
    • http://wotanuxofewaru.rf.gd/30608027501.pdf
    • https://8f6f9f04-f977-4239-955d-f6aecf2dd879.filesusr.com/ugd/81cd61_75e3e4219225459bbeabf85397b39f9f.pdf?index=true
    • https://s3.amazonaws.com/zafaronivaj/36720605081.pdf
    • https://s3.amazonaws.com/somisilegex/basic_spanish_words_worksheet.pdf
    • https://s3.amazonaws.com/podawakumepewez/jurnal_pencegahan_penyakit_jantung_koroner.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed26.bin
1a2b65341f240f248d35952eb6fa3ae8d0eb2094e81ca533977245f03261af88		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED26 5520 bytes
font_01_sfnt_off0000ffdf.bin
fd395c4cda34df65a5f34e05ca3775bfec28cb9ead13aa552cf193a7c2170c29		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFDF 12812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.