Malicious PDF — malware analysis report

Static analysis result for SHA-256 c906ffbc8a10acaa…

MALICIOUS

PDF

89.5 KB Created: 2021-03-14 10:15:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: bbfd06fd45df72faee7a8ffb16d1d8be SHA-1: cb7dfdd790b0dd3d257d3a561019eb5ac777b302 SHA-256: c906ffbc8a10acaab7771c80d4618276a47d126c95e47a9715a631299ac3f40c
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by both ML classification and ClamAV, specifically flagged as a phishing trojan. It contains numerous external links, many pointing to disposable hosting, suggesting a link farm or redirection mechanism. One prominent URL, "https://midufefew.ru/award?keyword=equations+and+inequalities+word+problems+pdf", is directly embedded and likely serves as the primary lure to a malicious site. The document body, though truncated, contains metadata suggesting it was generated by wkhtmltopdf and includes the lure phrase, reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=equations+and+inequalities+word+problems+pdf PDF link annotation
    • https://ziduxibuzogegu.weebly.com/uploads/1/3/4/0/134012824/3951670.pdfIn PDF document text
    • https://pesulomerusetus.weebly.com/uploads/1/3/4/1/134109359/verus.pdfIn PDF document text
    • https://valiwuvubeke.weebly.com/uploads/1/3/4/6/134694219/waritidilusama-dopujovex-degaxapedaz-sopikigatuzu.pdfIn PDF document text
    • https://letotanuvimipe.weebly.com/uploads/1/3/4/5/134598603/5570c368686dc1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7c03971-2f1a-4686-aed2-65acf87011d6/lusasosifidip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1888c7f-3cc8-4fcd-acf4-f3dc46fc7745/samsung_sch-r330_sim_card_location.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3137fc8a-9992-45b6-b18a-7bf66aafd37f/5_themes_of_geography_questions_and_answers.pdfIn PDF document text
    • https://9f9bd9fa-00fe-4673-b34e-9a629881f524.filesusr.com/ugd/09273f_264e8a05e55d465198f7c7bc9dad3992.pdf?index=trueIn PDF document text
    • https://83d12552-0bc1-4415-b221-1da25caacb9b.filesusr.com/ugd/1e11d0_48103e9f53964119a377da050d791ac5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/12188163-009a-42c9-8614-61c4592a1305/what_are_the_maxims_of_equity.pdfIn PDF document text
    • https://s3.amazonaws.com/fevobelijogal/rockstar_full_movie_hd_avi.pdfIn PDF document text
    • https://5ac9d038-517d-4536-97f6-676423289421.filesusr.com/ugd/b444d4_d1ed951930d04d83be70b687222bd24c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dumupa/naliwejijobebomilizudoro.pdfIn PDF document text
    • https://ef9d90ca-5811-4a1c-810e-75bcfae60121.filesusr.com/ugd/a33af7_c59823e719ec4c88a586a928efaa514e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kitakilesa/93049185861.pdfIn PDF document text
    • https://d525ee04-2a40-494f-8ba9-fee52f7b18ee.filesusr.com/ugd/8b8e24_29db55b0752747dd879f2590c957732a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/stones_of_barenziah_quest_markers_mod.pdfIn PDF document text
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_3518a4a267dc4ffc98ee92e764df54c4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/seriposuj/gulelunabixedaru.pdfIn PDF document text
    • https://s3.amazonaws.com/muwemivumazulax/nibinenemezowo.pdfIn PDF document text
    • https://99442e0c-e188-470f-b1e9-a2082f9e7f28.filesusr.com/ugd/2274a7_53e69b1271804773be5c5954ca27f46d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/libusamagowuvo/suvabetatedikekoja.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106D1 5500 bytes
SHA-256: d4059cfa9b9a4b078a8c2edeaf359269f0c277fb438f3dc0c4e1646f30915dae
font_01_sfnt_off0001197d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1197D 11760 bytes
SHA-256: 40458bc0b82c8d18c28d56de345b220f702fdf35c3103d4ebe8c2f62558f633d
font_02_sfnt_off000141eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x141EB 16348 bytes
SHA-256: 94b9ece9e75b6087aa34b6aeb73ff9aa73d21cfbdb0266ef6d0d36cca08943d8

Open this report in the interactive analyzer, or submit your own file for analysis.