Malicious PDF — malware analysis report

Static analysis result for SHA-256 c10588b74ec52f4f…

MALICIOUS

PDF

110.6 KB Created: 2021-03-24 18:50:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95245ea5070dde456b09c18b1e015d36 SHA-1: da5249af3a774226592bd51a1d133f4b3be7bdc2 SHA-256: c10588b74ec52f4f0b0d4356fbd3abe71b43fe9cbe9f61f73ca58388f0d4943f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm for SEO manipulation. One prominent URL, 'https://druttle.ru/wix?keyword=fifa+16+unlimited+coins+apk', indicates a lure for potentially unwanted software. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=fifa+16+unlimited+coins+apk
    • http://vitrinachel.ru/property_management_takeover_checklistmje51.pdf
    • http://arfeshome.com/tufapadilegorugaluwamavik8rzg.pdf
    • http://finansi-7.online/motolaxisidavek4c9aw.pdf
    • http://profoto22.ru/porter_cable_fn250b_reviewt452t.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7a7275b0-86f8-46fe-9ec6-522fa061cf11/92713494202.pdf
    • https://s3.amazonaws.com/lemerisinivum/77838397796.pdf
    • https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_214815c0d751423198c241c0595d9944.pdf?index=true
    • https://uploads.strikinglycdn.com/files/576dcf08-227b-4283-99fa-bf9f3fd24948/down_to_the_river_ukulele_chords.pdf
    • https://s3.amazonaws.com/suxugipipolazog/lefusuwinugukorepupuwokij.pdf
    • https://uploads.strikinglycdn.com/files/6884bb47-0d4c-459c-9f42-7e8106e1d76b/44931297145.pdf
    • https://uploads.strikinglycdn.com/files/c8eca15c-55d1-46fb-bd18-26fc8f22a681/what_happened_at_the_end_of_the_final_wish.pdf
    • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_de41f626adc0420880f80868097cd5f9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/85e6903d-da1a-47b6-b59b-79961d01c9cb/zyxel_pk5001z_firmware.pdf
    • http://xozisugogeg.epizy.com/concepts_of_networking.pdf
    • https://uploads.strikinglycdn.com/files/4f28c693-e556-4b91-9538-3d8ef620dbd3/8731710347.pdf
    • http://wulogakuzi.rf.gd/chill_pill_jar_template.pdf
    • https://uploads.strikinglycdn.com/files/1a850671-e41f-475f-95cc-9db18572e86f/43632131103.pdf
    • https://807eaacf-9fb6-4e16-bcb8-061395d1d132.filesusr.com/ugd/a3ef2e_88e50ae4c8894791ad9e36eeaeb6cc83.pdf?index=true
    • http://bixikaw.epizy.com/online_games_multiplayer_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015de8.bin
d2e2f2fc5e84e4d0aac9cfdf06f5908f1dbe3646f8ab5fb46d0c40db23c8d3f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15DE8 5428 bytes
font_01_sfnt_off00017063.bin
a650ae74a3fa46a9e897f5616b8af9ea6d09a39df93ebb2a0f5dcef2cccd16a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17063 11388 bytes
font_02_sfnt_off00019745.bin
39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19745 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.