Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf1ddc98e69b663c…

MALICIOUS

PDF

72.5 KB Created: 2021-03-19 09:08:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d3b175bb83fae6c1bccf75fe295564bb SHA-1: 5650938cce4957283c4162bbf5c39f2893d6e744 SHA-256: cf1ddc98e69b663ce4f1fffc8e0b0272ecd557052d9d90915ac5816a2898ed68
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains numerous external links, a common tactic for SEO link farms and phishing. The primary URL, https://dafemum.ru/wix?keyword=what+is+fossil+th+grade+4, suggests a lure to a site that may host malicious content or further phishing attempts. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=what+is+fossil+th+grade+4
    • http://golixudib.mypressonline.com/69150988205.pdf
    • http://mevesepegubisis.scienceontheweb.net/32598860816.pdf
    • http://begimewabifax.getenjoyment.net/almanca_eviri_teknikleri.pdf
    • https://static.s123-cdn-static.com/uploads/4490116/normal_5feb4c2886e81.pdf
    • https://static.s123-cdn-static.com/uploads/4478926/normal_5fcd68baa3297.pdf
    • http://sawemawe.mywebcommunity.org/warrior_of_the_light_-_volume_2.pdf
    • http://wedurorokim.mypressonline.com/14939512582.pdf
    • http://clientbluebadge.com/is_sig_p238_safe_to_carry154bg.pdf
    • http://forecast.bet/pavtube_video_converter_ultimatecma6f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_e9323c3935f341b892833ffe2acb9ffe.pdf?index=true
    • https://uploads.strikinglycdn.com/files/88c9dfee-c2a4-4d43-b30f-0bdbf5d90131/lotanefuvifi.pdf
    • https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_58ec78ee05ac4e61bd7596113f3e5c1a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9091fde4-797c-42b1-87d0-36e0397b03ce/lozewotuzumifiwad.pdf
    • https://e42ce0b3-f376-4cb5-9abe-507fdbb9570c.filesusr.com/ugd/603474_cb1234f6c4a948abaaf57e74f3bd0d20.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b605a632-dec5-4343-b601-28668d663112/suratuso.pdf
    • https://uploads.strikinglycdn.com/files/e984d7dc-7e2e-4abe-8058-f23a29d5043d/new_garmin_945_release_date.pdf
    • https://6dca1d0c-b102-4aa4-a312-d013f97c39dd.filesusr.com/ugd/fb87fb_b886b48eaa344c00830d97bb90271185.pdf?index=true
    • https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_f669f2c7e50245e79d3b6029c9b3d346.pdf?index=true
    • https://uploads.strikinglycdn.com/files/34bfc80e-ac06-4cc2-8885-47c989e544f0/xowonipapesonuzakokabo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df7b.bin
c78caa9e0c3e3dc7bb1ebf8766de5b4b902a0e04ee2749894e9689709508196c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF7B 5268 bytes
font_01_sfnt_off0000f176.bin
2e3f0a9988ecb107955f54d6bf04645569f53c1b6a0b55358e7ef02862609d05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF176 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.