Malicious PDF — malware analysis report

Static analysis result for SHA-256 e664a8b368d2e92a…

MALICIOUS

PDF

91.6 KB Created: 2021-03-17 05:57:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1399c17c6b5a8644a8f490eca315b92a SHA-1: 77c3b8c6230a66eceb35f86e2307a66defa50d93 SHA-256: e664a8b368d2e92ae38f56af6e0d0b9a85240fc603d8e0013928609798cd1489
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm or used for phishing. The primary malicious URL identified is https://dafemum.ru/award?keyword=agenda+2020+gratis+pdf, which is likely used to distribute further malicious content or redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=agenda+2020+gratis+pdf
    • https://dutudofedibajun.weebly.com/uploads/1/3/2/8/132815365/a1a3627d1d5dc04.pdf
    • https://wedutigumufezeb.weebly.com/uploads/1/3/4/6/134659425/laluwafameduni.pdf
    • http://vizemezezu.sportsontheweb.net/arduino_simulation_with_proteus.pdf
    • http://ruvogodozipabiv.scienceontheweb.net/how_to_find_roku_remote_model_number.pdf
    • https://kifeketefisub.weebly.com/uploads/1/3/5/3/135347095/c5e2c4b.pdf
    • http://bumawusuka.mypressonline.com/farmacocinetica_de_las_benzodiazepinas.pdf
    • http://netlysy.online/fipiroganebumojazabam4xoy7.pdf
    • https://zunukewonodej.weebly.com/uploads/1/3/1/4/131453615/riveserutodimo.pdf
    • http://sell-toclick.online/guys_and_dolls_scriptprjyb.pdf
    • http://nasufulorejuwe.mywebcommunity.org/lexozafazawibupalito.pdf
    • http://1-bog.ru/beeman_rs2_air_rifle_manualimatm.pdf
    • http://fudoviwil.mywebcommunity.org/stephen_king_it_movie_trailer_1990.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://43cb2d18-1589-43a7-b1c5-fe1278e1c76d.filesusr.com/ugd/370b54_4247c3baec004c4b87801495d7ec6aed.pdf?index=true
    • https://uploads.strikinglycdn.com/files/def44eca-7912-4072-b22e-759070d21037/what_are_the_methods_of_surface_mining.pdf
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_9b1ade72a07b41a0abf6774f54d60138.pdf?index=true
    • https://s3.amazonaws.com/kumasala/57094379692.pdf
    • https://s3.amazonaws.com/dedinavesute/pevubalaroz.pdf
    • https://s3.amazonaws.com/tevomenil/fosibofuvediti.pdf
    • https://s3.amazonaws.com/xamibebulosaxug/audio_editing_software_for_pc.pdf
    • https://uploads.strikinglycdn.com/files/79b73dbe-655a-4267-a4d9-3cfafaa4abb4/toro_vision_1_series_sprinkler_controller_box.pdf
    • https://s3.amazonaws.com/zedudo/89681711063.pdf
    • https://uploads.strikinglycdn.com/files/e1312316-e5ed-4d0f-b3b5-a83f62be2c9f/gajufazuzabekedof.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f136.bin
2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF136 6440 bytes
font_01_sfnt_off0001012b.bin
5d3b4ffaa9767a2c0ea294807ffddfc59d79bcf48cee7afd4cf822f236897d00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1012B 5120 bytes
font_02_sfnt_off00011299.bin
3ca35f1ce2efd7f6f675c39557e1536e29b8f5203ac37723f1048c4e857c84b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11299 12340 bytes
font_03_sfnt_off00013ae3.bin
c2500e0bbf8535682027dbedce08d041f6e9b3b8a79f192e59b9a11281518554		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13AE3 16188 bytes
font_04_sfnt_off00015023.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15023 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.