Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed3f611ade6ea4b1…

MALICIOUS

PDF

111.0 KB Created: 2021-03-21 23:29:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 77b3b95f71c93312800133c6713d7182 SHA-1: 1306680801b3803e7d4f34fc4b25bfcc67e443e5 SHA-256: ed3f611ade6ea4b14d0d5c47de4317d8d6135ada5696a9f6314012a811ef92d1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm and external URIs, indicating a likely attempt to redirect users to malicious websites. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=goosebumps+pdf+complete
    • http://rowomonug.mywebcommunity.org/99059723733.pdf
    • https://cdn-cms.f-static.net/uploads/4378827/normal_602824c27ff23.pdf
    • https://cdn-cms.f-static.net/uploads/4377116/normal_604cfb7626f0e.pdf
    • https://static.s123-cdn-static.com/uploads/4366984/normal_60078ef83ea6d.pdf
    • https://static.s123-cdn-static.com/uploads/4366047/normal_5fca670ee780e.pdf
    • http://mirijesuwakug.sportsontheweb.net/biwowibejegit.pdf
    • https://cdn-cms.f-static.net/uploads/4393883/normal_60192d5e5a9bf.pdf
    • http://kosamaritaj.getenjoyment.net/the_cost_of_discipleship_by_dietrich_bonhoeffer.pdf
    • http://bovewitavivebu.getenjoyment.net/how_to_read_and_write_mathematical_proofs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_28839cfb8361436fafd4cde417c5953b.pdf?index=true
    • https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_2d9ca14aa16a40b381e9ed11cee3e80c.pdf?index=true
    • http://soranodabiwegi.myartsonline.com/ziginokoxel.pdf
    • https://s3.amazonaws.com/jeworurowam/ashrae_90._1_2007_free.pdf
    • http://xemunebo.atwebpages.com/4725479717.pdf
    • https://s3.amazonaws.com/radubozufiwo/honeywell_hcm_350_-_best_buy.pdf
    • https://s3.amazonaws.com/tafogusegabomu/whats_the_definition_of_free_will.pdf
    • https://e064a861-6c7b-46af-b67a-66be1f32d776.filesusr.com/ugd/ec3e4b_e4b015ef9ef14bc29c6b558b02c7964e.pdf?index=true
    • https://8dfd47f4-e591-4377-92a3-bdbf91d41e5a.filesusr.com/ugd/a58b01_6101b0bac2d246beae0e43354f749359.pdf?index=true
    • https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_6fd1e270d0f24b5a81a65ff00f916e9b.pdf?index=true
    • https://aa5f33e9-793b-4807-a257-9eac84d314d0.filesusr.com/ugd/aa57b2_5bed14f506c5432ab87210bf614f701c.pdf?index=true
    • https://8ca15cf9-c5bf-4329-906a-32df3c7b5ab7.filesusr.com/ugd/4ca7f5_0ed6f32c3ff9439bb48947793105aa92.pdf?index=true
    • https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_f970aedffc4a471482637b2194b6af25.pdf?index=true
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_6f786fd5798a44d9838c4c143270e618.pdf?index=true
    • http://sogurorirerew.onlinewebshop.net/fedegelokuxowan.pdf
    • https://s3.amazonaws.com/pusolefosex/xabakijamebiduna.pdf
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_1761a161a00c4ec88b5e790e1fe50576.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016597.bin
bd319808ba3220684f2344d72afc869b86bc28619b2ebba4752f266e09876479		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16597 4892 bytes
font_01_sfnt_off0001764b.bin
09748d76c0c91a63f43af01c42668327c5c604f87984d1a22e2398d2eeac7fe4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1764B 12040 bytes
font_02_sfnt_off00019f5d.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19F5D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.