Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0defbfa09e03dd7…

MALICIOUS

PDF

74.2 KB Created: 2021-03-15 12:47:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cf892ae3e1bf9357a7c59517b91d8c24 SHA-1: eaca6865c105a2567d4893bf854bfff51ce2f0a1 SHA-256: e0defbfa09e03dd7665fa0ae3fd4dbc723c91999546cd2c796e34781a831c689
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying it as a "PDF_SEO_LINK_FARM" containing mass external PDF links. One prominent URL, "https://druttle.ru/award?keyword=algorithm+analysis+pdf+download", suggests a lure for users searching for specific content. ClamAV detection as "Pdf.Phishing.Trojan" further supports a malicious intent, likely related to phishing or a scam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=algorithm+analysis+pdf+download
    • https://static.s123-cdn-static.com/uploads/4379045/normal_5fefd129af6c9.pdf
    • http://idealica-it.website/41983371430h52t2.pdf
    • http://sreview.online/mavofamidulokexozad8yk2.pdf
    • http://datinge.site/is_there_any_nail_shop_open_todaywucxa.pdf
    • http://oficialshoes.site/how_many_calories_in_a_large_sonic_milkshake7rvpu.pdf
    • https://static.s123-cdn-static.com/uploads/4421039/normal_5fe1b15aaeae2.pdf
    • http://cloudplay.xyz/samsung_top_loading_washing_machine_repair_manualzxxdw.pdf
    • http://uaportal.site/67976196683itrod.pdf
    • http://tohld.in/consumer_reports_best_dyson_vacuum8sxac.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://09ec9d85-9312-4337-94d0-b84080e05f2e.filesusr.com/ugd/ac0094_bb7047a6b1e242a8a7f614cec5d017a7.pdf?index=true
    • https://dc58184e-bbba-402a-8e08-a55d552c8f3f.filesusr.com/ugd/0ebc1f_2ef832aec0b84e83b56679be4f11afec.pdf?index=true
    • https://s3.amazonaws.com/faxaxos/buwidojixukefaduv.pdf
    • https://s3.amazonaws.com/kikunojulejuj/93556207376.pdf
    • https://81da36f4-dec6-4bf4-836b-19ed67500659.filesusr.com/ugd/5fd5c1_6ecbfc1328874f498906c3bc65715e4e.pdf?index=true
    • https://02bc4616-4eae-4b38-b2c9-0e654f754ee0.filesusr.com/ugd/069df5_8acfebee00224109b35be3fba5781e17.pdf?index=true
    • https://s3.amazonaws.com/vixuwogetiv/guarantee_ing_form.pdf
    • https://s3.amazonaws.com/golepe/digizowojirovukugabezubu.pdf
    • https://32b33340-d9da-4ef7-b3bd-a0ac5134eb71.filesusr.com/ugd/adfa6f_51cadf7532214a3197472000d0dd0639.pdf?index=true
    • https://s3.amazonaws.com/xijalovelokolep/68141797020.pdf
    • https://3dcfbd4a-ef33-49dc-a04a-0aaf5307c30d.filesusr.com/ugd/b47706_d17e053f9a5f4e57a7479616851f9902.pdf?index=true
    • https://1261df91-4e32-40b2-8b8a-4050d3c54cbb.filesusr.com/ugd/df69c1_64120873ecfc4047bd659f1f389366e4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ddfc.bin
f30d9e680fdf9ced38d33739acc33f15137e2d169e848741e7af269fb062451f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDFC 5640 bytes
font_01_sfnt_off0000f114.bin
689c4a15b36a9476328ddd13185f92acf7f551243996d676b70ce2703fc41486		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF114 13696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.