Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf2d6c369985efc7…

MALICIOUS

PDF

79.7 KB Created: 2021-04-01 06:21:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 976d9e9598946e289b8ca6422c03c590 SHA-1: 7cc8ab81a212faa2e9b7977f092bf7ed93c15f79 SHA-256: cf2d6c369985efc76d11e1fabb93df2831cacf20f91df0e2c573e4a22539271e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. Several of these links point to domains associated with malicious activity, such as midufefew.ru and baginemesurewis.weebly.com. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or SEO abuse to drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/aws?utm_term=resistance+band+training+exercises
    • https://baginemesurewis.weebly.com/uploads/1/3/1/3/131380932/liwujapetixumum_jepefaz_lufegesupo.pdf
    • http://dufigep.scienceontheweb.net/adobe_acrobat_reader_append.pdf
    • http://pedumerik.sportsontheweb.net/electrical_cable_chart.pdf
    • https://nawexolaka.weebly.com/uploads/1/3/4/7/134704757/3510904.pdf
    • https://latibexuwer.weebly.com/uploads/1/3/0/7/130776356/9fde867ab.pdf
    • http://turubegu.sportsontheweb.net/bonilapisafakozikalibilaj.pdf
    • https://malabukepi.weebly.com/uploads/1/3/0/9/130969546/gelopobovifetalof.pdf
    • https://fubomagasikeka.weebly.com/uploads/1/3/4/4/134474343/nivudewe-letem-komisumumame-lumeregadamilol.pdf
    • https://lidovoji.weebly.com/uploads/1/3/4/3/134313359/6289492.pdf
    • https://zitewamim.weebly.com/uploads/1/3/1/4/131454986/kalezud.pdf
    • http://sogixusi.medianewsonline.com/litemujefewixajugumupe.pdf
    • https://xibupofuku.weebly.com/uploads/1/3/5/3/135306475/verototuw.pdf
    • https://xonujofepip.weebly.com/uploads/1/3/4/3/134385468/6e0b5fdb6.pdf
    • http://xamoxipuwizutux.scienceontheweb.net/anton_chekhov_short_stories_audiobook.pdf
    • http://roxelejabojafe.scienceontheweb.net/how_to_change_day_in_casio_g_shock.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/e3618546-6c84-4304-97b5-1693186b8a67/bafifotexemi.pdf
    • https://uploads.strikinglycdn.com/files/6315f5fc-84a0-47e2-a63c-987eda462443/minn_kota_battery_charger_bass_pro.pdf
    • https://uploads.strikinglycdn.com/files/57b62b36-07f5-4d72-8cf3-e509bfbb2e42/84009792746.pdf
    • https://uploads.strikinglycdn.com/files/317422d9-11d5-433d-9576-1dffca1f0cac/dazinokusomexezode.pdf
    • https://uploads.strikinglycdn.com/files/c82ae952-1dd8-46cb-8bb6-326ea1c03faa/black_and_decker_electromate_400_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/4e07d8f0-00af-4522-b818-f9484b7e3020/wipulejepavefut.pdf
    • https://uploads.strikinglycdn.com/files/f27e8975-3698-479b-9d81-1522ae8e9bfd/fogadajugejubawu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed83.bin
fcf648f2ac10e3c82f116c824661a63e47a8a7bf88a09c84c52763ea1bff1634		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED83 4968 bytes
font_01_sfnt_off0000fe6e.bin
28715b9a026d484c27ca1d376c69d2465b16ebbaa0d960973fa0f24a4a40c183		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE6E 10680 bytes
font_02_sfnt_off000122f9.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122F9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.