Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb2271b82fa2b7cb…

MALICIOUS

PDF

81.2 KB Created: 2021-03-06 07:26:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a91e677e9c77343c6f0237188a22675 SHA-1: 1687961f96edbcf4445ed73a63555bab0e053104 SHA-256: cb2271b82fa2b7cbf767611090d4e85629140c52eb98117106c687364fbaa93a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or SEO spam campaign. It contains a large number of external links, many pointing to PDF files, suggesting a link farm or redirection mechanism. The primary malicious URL identified is https://dafemum.ru/123?utm_term=best+quotes+from+rising+strong.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=best+quotes+from+rising+strong
    • https://static.s123-cdn-static.com/uploads/4481158/normal_5ffbc278c0737.pdf
    • https://vonosupaxeme.weebly.com/uploads/1/3/0/7/130740497/b5d34.pdf
    • https://cdn-cms.f-static.net/uploads/4444369/normal_600be48c56fa1.pdf
    • https://jupifezugaj.weebly.com/uploads/1/3/0/7/130739886/tenepelazulodo_kifal_zadeviriwur_dixoj.pdf
    • http://tulomodev.getenjoyment.net/dexavonirabaxapodi.pdf
    • http://munasimowijuxi.getenjoyment.net/lamunogobipepani.pdf
    • http://lobabinuladeri.medianewsonline.com/sililabosizupani.pdf
    • https://static.s123-cdn-static.com/uploads/4478134/normal_5fef81bbcfcd2.pdf
    • https://rijopadanag.weebly.com/uploads/1/3/1/0/131070137/3761659.pdf
    • https://letavozogat.weebly.com/uploads/1/3/5/9/135978758/fivowimiraf-zesejoramezesu-wolabuxevefujuf-mutufonaw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d8d078ea-10ec-4787-8e21-ef6e32b87a24.filesusr.com/ugd/8f6098_792de8a1c7294a62ae0da0e5a31774c9.pdf?index=true
    • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_0a87e01e6999429581eacdd5ee9b8289.pdf?index=true
    • https://uploads.strikinglycdn.com/files/467c3d3b-a89f-428a-82a8-a12965b8f6f3/22285942183.pdf
    • https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_a5e7126d6d2241caa792dd98c865fd9c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a8c95bb9-71b1-4733-88a1-38fd936b41b3/butivovowowa.pdf
    • http://vidugozu.atwebpages.com/88016507182.pdf
    • https://uploads.strikinglycdn.com/files/e46752e1-27f4-491f-affc-1e6b11b2900e/buenos_dias_princesa_hermosa_poemas.pdf
    • http://bifiwapaz.onlinewebshop.net/ranobok.pdf
    • http://satogitexuvo.myartsonline.com/how_to_print_with_black_ink_only_when_color_is_empty_xerox.pdf
    • https://uploads.strikinglycdn.com/files/4644cd39-ad48-47dd-970a-29b82bb440ab/what_are_standard_enthalpy_change_of_formation.pdf
    • http://pusapovewazigu.onlinewebshop.net/mtd_snowblower_drive_belt.pdf
    • https://uploads.strikinglycdn.com/files/defbff31-efde-4ab5-82c4-d27f9133af2f/zijabu.pdf
    • http://jumepenitujox.atwebpages.com/java_j2ee_interview_questions_and_answers_for_10_years_experience.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001017a.bin
cd1deda81003567f3391b9a5ad852a71de9fe111869d95e242c1030a5e37699c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1017A 5020 bytes
font_01_sfnt_off00011284.bin
63783673a16db6edfff3573eca639d1d12a553ffcfda33854dc802780440dab7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11284 10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.