Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddbdad965b91501f…

MALICIOUS

PDF

79.2 KB Created: 2021-04-05 18:41:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c623f964ca353051b0bb714368de30ab SHA-1: d9081a3f140d9d0d476890e1225931ce2b1aae84 SHA-256: ddbdad965b91501f13768e8694fa48bd6e747868bfa3be653ba5e13e572d9452
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains a large number of external links, many of which are likely part of a link farm designed to improve SEO for malicious content. The embedded URLs, such as https://seumenha.ru/strik?utm_term=how+to+draw+graph+in+excel+2007+pdf, suggest a phishing attempt disguised as a search result. No scripts were extracted, but the PDF structure and numerous external links point towards a malicious intent to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+draw+graph+in+excel+2007+pdf
    • http://top-agent.ru/self_awareness_worksheets_therapyl0wja.pdf
    • http://lulumel.66ghz.com/basha_songs_tamil_free.pdf
    • http://francobusiness.com/vomujoxufidowakazaco5ty.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wemoragi.rf.gd/wagogese.pdf
    • https://s3.amazonaws.com/pegek/nosidubotudolekaga.pdf
    • http://dawobamam.epizy.com/zukiga.pdf
    • https://49550882-97ce-44db-a38b-6e383bb81149.filesusr.com/ugd/062c90_27b8f15216894d5ab647b1681ddf2e32.pdf?index=true
    • https://ca39a19f-16f9-469f-ab0b-65ec0463b8d0.filesusr.com/ugd/cc9b97_362b266f11064b60829dc16114096777.pdf?index=true
    • http://fikapitisox.rf.gd/flowers_for_algernon.pdf
    • https://3437305d-a3f4-4f94-9a63-846dd410f5be.filesusr.com/ugd/ffe76b_bc7e42cff1344e35b1e8139bd0c1fd0f.pdf?index=true
    • https://9e4d96d7-92f1-4145-9aac-d1976e75dfe6.filesusr.com/ugd/49a98b_dd437c91887d4ad2b50ba92bd302d387.pdf?index=true
    • https://s3.amazonaws.com/lupebesu/celestine_ukwu_songs_free.pdf
    • https://s3.amazonaws.com/kofabube/lifibipa.pdf
    • https://254a6a59-343e-4b7e-907c-c4819e171fff.filesusr.com/ugd/decf6f_9faee8e60be248549f7d01f317e1f165.pdf?index=true
    • https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_a72eda0080f2438a85bcfa01602bd959.pdf?index=true
    • https://s3.amazonaws.com/zedilegol/fofoguges.pdf
    • https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_590ea65c1ad140f1bc12653f5d674388.pdf?index=true
    • http://vodirid.epizy.com/quarterstaff_training_manual.pdf
    • https://s3.amazonaws.com/bokelur/tefotemupeledodabuf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f679.bin
8ff4af9dcb0a8506f19eed38253a92b26771ce9139b224f72a0b4085feb1fb50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF679 5716 bytes
font_01_sfnt_off00010a15.bin
2f8c9a0039fddf2ea6185385156ad7cd3eec440872b48d88e59e0101503697c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A15 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.