Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5d49264ee8ee2df…

MALICIOUS

PDF

73.5 KB Created: 2021-06-06 10:02:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4604e6774623343d4ea03fac78dfadce SHA-1: 9349a265e9574174643d97096986a657a40a10ee SHA-256: d5d49264ee8ee2dfb8737a60c359fa2088e9901d2bff3118439007befc41e0f6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results. The primary URL, 'https://ketchas.ru/pbw?utm_term=how+to+take+apart+and+clean+dyson+fan', suggests a lure related to technical information. While no scripts were explicitly extracted, the PDF structure and the heuristic 'PDF_SEO_LINK_FARM' indicate a malicious intent to redirect users to potentially harmful websites, possibly for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/pbw?utm_term=how+to+take+apart+and+clean+dyson+fan
    • https://jaginozowelizuf.weebly.com/uploads/1/3/4/7/134729204/2459900.pdf
    • https://gedibixofesona.weebly.com/uploads/1/3/4/6/134688069/zipanukapomepu.pdf
    • https://static.s123-cdn-static.com/uploads/4450046/normal_5fcc8f2a71857.pdf
    • https://bowalizixoled.weebly.com/uploads/1/3/1/8/131872289/bonezuvuvevitutubap.pdf
    • https://cdn-cms.f-static.net/uploads/4408462/normal_6033f4dc22267.pdf
    • https://cdn-cms.f-static.net/uploads/4419192/normal_603f0dc9212a9.pdf
    • https://kukezedom.weebly.com/uploads/1/3/4/6/134629177/5344600.pdf
    • https://nigakanal.weebly.com/uploads/1/3/4/5/134527226/gederivaxo-xuveza-babovonukufu-xexugikajires.pdf
    • https://topifovav.weebly.com/uploads/1/3/4/5/134595147/gisemojelefeteliwoj.pdf
    • https://cdn-cms.f-static.net/uploads/4380871/normal_603c68fe75153.pdf
    • https://bivesezuwewosup.weebly.com/uploads/1/3/4/7/134765681/rajux-vapanewetuk-zogarezokonomuv.pdf
    • https://putesoborufo.weebly.com/uploads/1/3/0/8/130814126/riduweda-zujadujegarev-mosisilogi-nerivoj.pdf
    • https://cdn-cms.f-static.net/uploads/4407793/normal_5fd2277cbab9d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b7a3aa3d-58c7-4d34-ba61-3c07a9b77c11/family_therapist_near_me_free.pdf
    • http://nukuxim.pbworks.com/f/65289534941.pdf
    • http://fixulirulafa.pbworks.com/f/zudixokuf.pdf
    • http://gogoporiwo.pbworks.com/f/a_whole_new_world_violin_and_piano_sheet_music_free.pdf
    • https://uploads.strikinglycdn.com/files/88609f47-9aae-4d32-8fc9-1fcedaaaa70a/96069703047.pdf
    • https://uploads.strikinglycdn.com/files/dc4b4485-9512-4884-aa4b-0c3bcf8d7c42/zombie_assault_sniper_mod_apkfine.com.pdf
    • http://fogofalo.pbworks.com/w/file/fetch/144697746/goduxogojurenatibe.pdf
    • http://pinurakus.pbworks.com/w/file/fetch/144533037/smart_home_security_systems_nz.pdf
    • https://uploads.strikinglycdn.com/files/69284d4c-f25f-4ff2-abb8-c3199c0347b1/50395533010.pdf
    • http://wijozuzapusa.pbworks.com/f/tirasex.pdf
    • http://fudotedafeji.pbworks.com/f/my_bot_clash_of_clans_download.pdf
    • http://paditoxef.pbworks.com/f/44453597665.pdf
    • https://uploads.strikinglycdn.com/files/6fcc275e-ea12-4fa8-b9fd-f4f1a6988302/diagrama_de_conexin_motor_monofasico_siemens.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2c1.bin
5f32fdc25dc78ff92b4e0c1af9ff50aa1f68622a90c7feb40da9bc8fa53d736f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2C1 5368 bytes
font_01_sfnt_off0000f52f.bin
e632da7f53ac32bf617492c176b278f8b715abf74eb828f65260eee80016c38d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF52F 10276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.