Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1f5a1d8203c1a72…

MALICIOUS

PDF

104.2 KB Created: 2021-03-07 23:06:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 942eb84ae06faf0d7c33dece7c857382 SHA-1: d8a2afdd840003a0d8ecaac7c7ff274d9d524fa2 SHA-256: e1f5a1d8203c1a7273738207f73f94ae858f03ca8716649897621e758150a63d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, pointing to various domains including 'fokemale.ru' and 'tb-films.ru'. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or a link-based attack. No scripts were extracted, but the PDF structure itself is used to host and distribute malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=flashpoint+comics+explained
    • http://tb-films.ru/5067063805266nly.pdf
    • http://idealica-italiaofficial.site/ipad_mini_pro_2020_gsmarena7lx1z.pdf
    • http://halfraire.xyz/pisosewuwrnpu.pdf
    • http://gbarb.me/silent_letters_in_english_listfbjh0.pdf
    • http://dress-russia.ru/2343015752scvtm.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/0c86f8f6-85a9-4fe4-a5ba-50f8d4a2ca66/how_to_use_a_smoky_mountain_electric_smoker.pdf
    • https://uploads.strikinglycdn.com/files/a538e6c1-0e45-43a0-9793-fcae6c51964e/2010_chevy_malibu_headlight_bulb_replacement.pdf
    • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_ea346a3eaf3647efb7903e673a204bc3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9ac990c2-d4a3-4ef7-8248-b93e43a0c04d/nofevofonepuwawavilifa.pdf
    • https://s3.amazonaws.com/vetamedisoz/garepuwedosarimuxiwus.pdf
    • https://uploads.strikinglycdn.com/files/fc8a6b65-c645-480c-abdc-99ab12df49bf/wordly_wise_3000_book_8_lesson_5.pdf
    • https://uploads.strikinglycdn.com/files/9adeb40a-2896-490e-b4a1-bdc8452ff874/15176994380.pdf
    • https://f3874c2d-c116-49c2-b7b6-9300dc8fc43e.filesusr.com/ugd/b11f6d_72a47ca6ccbc4dda9c810f17b9c7c313.pdf?index=true
    • https://uploads.strikinglycdn.com/files/428ac73e-a00f-47af-adb5-cfb48cffc5d7/surizipuratubejuwaworex.pdf
    • https://s3.amazonaws.com/vuraradaso/paforalinumoles.pdf
    • https://uploads.strikinglycdn.com/files/6167d646-b9b5-48e3-bd97-cfd1b77b93b3/99446922618.pdf
    • https://ca7c05ed-d233-4774-9cf9-08ff86aa6c73.filesusr.com/ugd/b42fd6_889d9578461f4401bd18b73e45074767.pdf?index=true
    • https://uploads.strikinglycdn.com/files/073fcb92-dd5c-491b-8648-a8759fbccedc/2879704290.pdf
    • https://uploads.strikinglycdn.com/files/6d477e1e-d479-4c00-af02-1cd9ed3babb9/jayco_hummingbird_owners_forum.pdf
    • https://551f0ad2-75d1-4009-b90b-2f3e3e20230b.filesusr.com/ugd/c2bf0a_3f8566c699c0428ba8c6b2655b91bcb1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/28245225-51bc-4e06-a352-40c832007941/45340901417.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013278.bin
5057c1f0964e1b0e64e1665cd9abcb2451024632749fdc362db3449415caefcf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13278 7856 bytes
font_01_sfnt_off00014d48.bin
ae9c90bb4dd066dd9fb4fa3f1d45143236e2bdacec11e889dd53e34dc7690efe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14D48 5028 bytes
font_02_sfnt_off00015e2e.bin
6793c9496aa6096f92b82333f30536e0437d5860087d054507715b66700a57ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E2E 11232 bytes
font_03_sfnt_off00018474.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18474 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.