Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd3675b3228277ef…

MALICIOUS

PDF

90.2 KB Created: 2021-03-31 12:32:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4668f01173476fb606d35a682b57548c SHA-1: 14bd5d72c1a36814571568a895f34eda44f2ae05 SHA-256: dd3675b3228277ef960609d242442033374f2dc7c64b86e2293fd60074d34cb7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to suspicious domains, suggesting a link farm or redirection to malicious content. The heuristic PDF_SEO_LINK_FARM indicates a large number of generated links, and the ML classifier and ClamAV detection strongly suggest malicious intent. The document body, though heavily obfuscated, contains keywords related to cracked software, likely serving as a lure to drive traffic to the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=adobe+illustrator+cracked+reddit
    • https://cdn.sqhk.co/nowonipewo/hdqLbgf/rokutetoniwuwaberumoliror.pdf
    • https://kuxubujokug.weebly.com/uploads/1/3/0/7/130775750/4106445.pdf
    • https://motuzepiruwilo.weebly.com/uploads/1/3/4/3/134348631/e3681fb.pdf
    • https://cdn.sqhk.co/rizitewav/gfhajh3/oxygen_atomic_structure.pdf
    • http://bibivire.mygamesonline.org/85832562989.pdf
    • https://cdn.sqhk.co/dijabidasu/Bjcfggs/vipisonasizeruma.pdf
    • https://cdn.sqhk.co/mapelimujeku/VgeQTig/best_escape_game_520_saltwater_crocodile_rescue_team.pdf
    • https://cdn.sqhk.co/vekuniruf/hdPBgh9/interstellar_dust_definition_in_astronomy.pdf
    • http://juwaniwabi.medianewsonline.com/josikebadaruferafin.pdf
    • https://jetijejage.weebly.com/uploads/1/3/4/3/134319548/wotizalezuzifab_jasoguzus_zebononixedowov.pdf
    • https://mugunerer.weebly.com/uploads/1/3/4/4/134479547/gunagul_linuxuga_divowew.pdf
    • https://dutajidadu.weebly.com/uploads/1/3/4/7/134730474/daniza-gojaloto-nijur-zekazadevosos.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/9d592e6d-39ca-438a-b606-85c7399a9191/rslogix_5000_vs_studio_5000.pdf
    • https://uploads.strikinglycdn.com/files/c4618854-35a9-4f50-99f6-12be224fc866/nuvipejagavawex.pdf
    • https://s3.amazonaws.com/baxunaf/samuel_beckett_bridge_moving.pdf
    • https://uploads.strikinglycdn.com/files/d5ac63a9-3da3-4751-8c86-b9996bf159db/sierra_bullets_reloading_manual_2nd_edition.pdf
    • https://s3.amazonaws.com/gozilum/69363112877.pdf
    • https://uploads.strikinglycdn.com/files/4f57e21a-ac41-4dc6-94d5-e96bb43462e0/functional_exercises_for_seniors.pdf
    • https://s3.amazonaws.com/kelukakeb/maytag_bravos_xl_washer_error_code_ul.pdf
    • https://s3.amazonaws.com/mamukawaxatali/lowurizagame.pdf
    • https://uploads.strikinglycdn.com/files/4f879176-3dae-45d4-8b82-cc4af3d54afc/18003033743.pdf
    • https://s3.amazonaws.com/xufaxoferugod/wokukabizasowedogopat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100c7.bin
089c45e3aa5176efeeacc0012ef8a8e023c94ebff6e91bbbd50adb16edd5f055		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100C7 4904 bytes
font_01_sfnt_off0001117f.bin
92ba2e78472a8e8b076b22acfee07b9c26d492bbd99bbbf002d056aaf6cf54c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1117F 11040 bytes
font_02_sfnt_off00013755.bin
c4441e48b2f68604838bd51e3092d1355fc6ad73caca962ec91191dcf11ac5c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13755 16224 bytes
font_03_sfnt_off00014c7c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C7C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.