Malicious PDF — malware analysis report

Static analysis result for SHA-256 d20d0a8cc93bca92…

MALICIOUS

PDF

64.0 KB Created: 2021-03-23 13:33:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aa287f1fcd21fa695fe8be3b943a4411 SHA-1: 2124627254eec9690e55aff2598b6ae27e16c881 SHA-256: d20d0a8cc93bca92e09471ca6272cde9d56ac58f2c235171ff7063ec9ca90bc8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to domains associated with link farms and SEO spam. The primary embedded URL, 'https://dafemum.ru/award?keyword=emerald+tablets+of+thoth+pdf+download', suggests a lure to download content related to 'Emerald tablets of Thoth'. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for distributing further malware or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9793

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=emerald+tablets+of+thoth+pdf+download
    • https://wojulifurezusek.weebly.com/uploads/1/3/1/4/131438898/motefenedaposev.pdf
    • http://vittorguxx.site/mango_street_book_online15yqe.pdf
    • https://muzufuwuvul.weebly.com/uploads/1/3/2/3/132302955/8032840.pdf
    • https://zediruli.weebly.com/uploads/1/3/4/7/134725524/9607728.pdf
    • http://watercart.ru/87840176713g6j0b.pdf
    • https://lajexupizad.weebly.com/uploads/1/3/0/7/130775806/7066535.pdf
    • https://juxibawazorar.weebly.com/uploads/1/3/3/9/133997202/8360963.pdf
    • https://gonufefimexej.weebly.com/uploads/1/3/4/8/134892828/junulema_vezuxo_vanadabamo_setogito.pdf
    • http://fastgetme.online/how_to_update_sims_3_game_launcheru5d0e.pdf
    • http://leadtop.co/power_book_2_ghost_episode_1118stww.pdf
    • http://fibakigefejep.66ghz.com/gufaxaxevituluma.pdf
    • https://pafebexazare.weebly.com/uploads/1/3/1/1/131163914/1269103.pdf
    • http://stnold.com/death_note_characters_long_hairm9apa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9764acbf-314d-4ce5-915b-073d13b82a44/pretty_little_liars_reboot_original_sin.pdf
    • https://48e4e0df-78ce-4736-8797-27735e68dc67.filesusr.com/ugd/f3b179_2d1db8830b8847a99f7beb9fdf57cd22.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8db98ffb-b0b2-4eb6-b731-067287378b99/jajevuwokozaxorame.pdf
    • https://uploads.strikinglycdn.com/files/047ebaec-c4dc-42b9-bbf8-490683fb3241/how_to_reset_my_weight_watchers_points_plus_calculator.pdf
    • http://semerobaragizeg.epizy.com/38093489536.pdf
    • https://0793e221-2e7e-4176-aae8-4ff4b75d8f7a.filesusr.com/ugd/64bd79_b01fc6be7c9c407bbc53d7106c52cc50.pdf?index=true
    • http://zozadugaweguj.epizy.com/liwovanu.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c49f.bin
392fc1a35a5ca4c19681bc5db3a5ee4e062f01e9c7e3167d04a330d3a90e8a57
pdf-font-stream PDF embedded font (sfnt) at offset 0xC49F 5468 bytes
font_01_sfnt_off0000d712.bin
517ee6b96f886fa2b42cfb8daa3a4e0b6f457905f5934e5259005bd4aec557e2
pdf-font-stream PDF embedded font (sfnt) at offset 0xD712 11972 bytes