Malicious PDF — malware analysis report

Static analysis result for SHA-256 d950ff634a8794aa…

MALICIOUS

PDF

72.1 KB Created: 2021-03-20 16:49:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b30feb1542b3ad646e88f28e4af6f76 SHA-1: b030cac8812e990572d1743d6503c95a8a23a60f SHA-256: d950ff634a8794aa567bd9e98f04ea27a2ff69174ec6147ccc9de5d303186018
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, suggesting a link farm or phishing attempt. The presence of embedded URLs and the PDF structure indicate it is designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=potenciometro+en+ingles
    • https://cdn-cms.f-static.net/uploads/4484993/normal_60118d0d5ff28.pdf
    • https://cdn-cms.f-static.net/uploads/4366063/normal_6013183ca5c33.pdf
    • http://vonoxafaku.scienceontheweb.net/molovazuz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://9e6c4f0b-3406-4274-bf8a-5be7f948d240.filesusr.com/ugd/45c6ff_e14078e9be784135a5e8f1e3a236b753.pdf?index=true
    • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_842ac4fecf5b46a4adc8fb3021c68d2e.pdf?index=true
    • https://s3.amazonaws.com/sezebepit/tekixenoxemasolokotifama.pdf
    • https://s3.amazonaws.com/baxekojojexusol/53504503487.pdf
    • https://9387bd13-3746-4408-b474-2867f26e464d.filesusr.com/ugd/ace02d_f34b1a37f74e4746a3dbe2c00f7e376d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9bad2925-2258-4a6d-9caf-35805a802562/84739528105.pdf
    • https://uploads.strikinglycdn.com/files/8df30743-e6c6-4761-bc04-0584b37e3974/joradevaxagugoberipim.pdf
    • https://d670dda7-df53-4ef1-8eda-d3256df28744.filesusr.com/ugd/dbbbec_2c94010189e340b3925e12bd2a2a2d20.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c9dc821a-0f8a-4aa5-ba90-b46bf68963cb/hp_laserjet_p2035n_offline.pdf
    • https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_db578a6d97d54030851b0fc857e91439.pdf?index=true
    • https://s3.amazonaws.com/gelawiweza/caste_validity_application_form_maharashtra.pdf
    • https://s3.amazonaws.com/godewumazek/tuvipileremev.pdf
    • http://lijowavatajo.myartsonline.com/why_are_there_two_versions_of_deadpool.pdf
    • http://rewuwuja.onlinewebshop.net/how_to_clean_my_bissell_spotbot.pdf
    • https://89d37d93-eaf9-4fc7-8d5e-07438b8f18e7.filesusr.com/ugd/e80f4c_059be6ea80d44193adbba5ab907a7dd6.pdf?index=true
    • https://3eeb541e-75be-486c-a732-b1e279b2a932.filesusr.com/ugd/eaab1c_e8647aa8ae604dddaab053379cc63661.pdf?index=true
    • https://s3.amazonaws.com/wifukedot/jorewanu.pdf
    • https://9579f988-9383-433c-acf3-5fff76e0c882.filesusr.com/ugd/191a6d_1d5494f360014847bf51579c2ccf825e.pdf?index=true
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_64629da1eccf4d698f997cabe975e228.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbc6.bin
dfc6f940dcf05c02ae31cb4fdef7ec4a81e1f0d10607aec0009f3f42940d0103		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBC6 4912 bytes
font_01_sfnt_off0000ec69.bin
7c827bbeaa2b437fcb70550aec6c2cdc7940e9b9feef0d7cca51041bbb759db2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC69 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.