Malicious PDF — malware analysis report

Static analysis result for SHA-256 db0075436bef46db…

MALICIOUS

PDF

79.8 KB Created: 2021-05-18 08:12:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4a1abdd335bbbabaa5043fdbb79a0b5d SHA-1: 9053b6b8d0a300c97906e0c073dc8ef81515d2d5 SHA-256: db0075436bef46db50c41e6b11eb61fe28b6c315e303e4ec85e320253b818f02
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, many of which are to benign content, but one key URL points to a domain associated with phishing. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm designed to obscure malicious activity. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=acer+aspire+5750+touchpad+driver+windows+10
    • https://diwolusetu.weebly.com/uploads/1/3/5/2/135299278/9692523.pdf
    • https://vovowiki.weebly.com/uploads/1/3/2/3/132303124/dujexadixiloxi-robew.pdf
    • https://xuxufagitagagi.weebly.com/uploads/1/3/0/7/130740521/renejanet-tepamazudoref-zalare.pdf
    • https://dujakoxuk.weebly.com/uploads/1/3/1/4/131483447/c811ff8e594d5e.pdf
    • https://kajipeluvo.weebly.com/uploads/1/3/4/3/134318391/lopatudilarut.pdf
    • https://latewumopinigan.weebly.com/uploads/1/3/4/3/134313498/6abb71.pdf
    • https://gefobivuvevu.weebly.com/uploads/1/3/1/3/131380717/239033.pdf
    • https://xogepojofaridel.weebly.com/uploads/1/3/2/7/132741214/64511ecc.pdf
    • https://gofazawadatefit.weebly.com/uploads/1/3/5/3/135349405/revowesajojorab-nubij-fowigap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/bfbaac96-34c2-4d99-b219-7b8dc2902796/65438527996.pdf
    • https://uploads.strikinglycdn.com/files/419a59cd-6e9b-4945-8df7-ca5ad2929d57/ncaa_div_ii_football_scores.pdf
    • https://uploads.strikinglycdn.com/files/b6772e11-1652-469e-8750-dbedecbd4a25/37494433273.pdf
    • https://uploads.strikinglycdn.com/files/5550dd8e-3b38-4496-9df6-378774333c63/how_to_make_a_furnace_in_minecraft_ps3.pdf
    • https://uploads.strikinglycdn.com/files/1122a473-c688-40b4-b083-398614e875d3/chemical_structure_of_coconut_oil.pdf
    • https://s3.amazonaws.com/wupuxus/buzzfeed_gift_guide.pdf
    • https://uploads.strikinglycdn.com/files/2ac664fb-e9cc-4fbc-99d7-c590b31fc676/54464495025.pdf
    • https://uploads.strikinglycdn.com/files/e84f6ba5-8f6a-48e4-9ca1-ecbfc8263dbc/moodjuice_anxiety.pdf
    • https://uploads.strikinglycdn.com/files/16b0d435-659b-4ba5-8668-d802b4e9d1b9/volkswagen_canada_service_prices.pdf
    • https://s3.amazonaws.com/kagedatabujo/super_mario_sunshine_blue_coins_noki_bay.pdf
    • https://s3.amazonaws.com/jeduzizonox/biografia_para_encontrarme_mario_benedetti_gratis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e90f.bin
67d682e8c681118fc97578cbb796824880782274410055918b6dabf90ea822d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE90F 5552 bytes
font_01_sfnt_off0000fbff.bin
10d274f21aaa7d5007b1ae954027820ae66b6e114e4ce2e9aa8bca1acbbceb6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBFF 11268 bytes
font_02_sfnt_off000121e3.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121E3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.