Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4eb82670e0fa743…

MALICIOUS

PDF

73.6 KB Created: 2021-03-20 18:52:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: e272dd9700912461af333de7d1d74f44 SHA-1: bf32cb1488e6fd165013a90906a41c67134de423 SHA-256: e4eb82670e0fa743086c246e07d45e44bd56aff1ce7335fa8eca1d358fd4b3bf
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. It contains numerous embedded URLs, with one pointing to 'dugedepap.ru', which is indicative of a phishing or malware distribution attempt. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests the document's purpose is to act as a link farm, likely to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=west+point+bridge+designer+cheapest+bridge+24+meters PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368504/normal_6043e0fb8a822.pdfIn PDF document text
    • https://cdn.sqhk.co/keliziniw/gfVm4r6/flippy_race_hack_game_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420260/normal_5fde90a1ce3ed.pdfIn PDF document text
    • https://cdn.sqhk.co/fematixub/hajbnib/befemolaruv.pdfIn PDF document text
    • http://fuzebopirafune.22web.org/64967210214.pdfIn PDF document text
    • http://keepsufi.space/schumacher_battery_charger_partsvdhrr.pdfIn PDF document text
    • http://tk-time.site/theft_of_swords_free_downloadsq7tc.pdfIn PDF document text
    • http://sallehq.xyz/89733309343f8e3d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379053/normal_600a109be3986.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d4a5bed-37c5-4cd2-a2a4-efbf3e85c768/links_awakening_manual.pdfIn PDF document text
    • http://xafalelo.rf.gd/idealism_and_materialism_in_philosophy.pdfIn PDF document text
    • https://s3.amazonaws.com/figugipopar/83629766988.pdfIn PDF document text
    • https://s3.amazonaws.com/libosokune/how_to_fix_paper_jam_epson_l360.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/453534cf-b2ae-44eb-a79d-ba803e5b04be/how_to_start_a_private_investigator_business_in_massachusetts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4461cd4-f5a5-4228-aa83-cb1335dd33b3/pezonuzatinuranenadon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ecf9c8c-3c1c-41b5-880a-a5ff36ff6849/kupexugalidosusokerobode.pdfIn PDF document text
    • http://wezexezawudev.rf.gd/6458598882.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc0596cb-cd1e-4da4-94b6-2aec5eb0d817/12627433075.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e058.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE058 5828 bytes
SHA-256: bb32d166044438a59216be64f634fd01f1afb4f78c63ea685fc227f3524e6e79
font_01_sfnt_off0000f411.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF411 10868 bytes
SHA-256: 7bb58df592070dd0a98d40dbf6858b52aa0ce67be4cb915b9ea1348989731b23

Open this report in the interactive analyzer, or submit your own file for analysis.