Malicious PDF — malware analysis report

Static analysis result for SHA-256 edd5a58c8be739d6…

MALICIOUS

PDF

76.3 KB Created: 2021-03-29 01:49:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 422c143ea980f44decce01a093b20d09 SHA-1: 8c7c49e337c8ad2d9935441e2efad22112b0b58d SHA-256: edd5a58c8be739d6d1c749e2009336a435e6f76ef4bab67c8b2542aafab7e4cb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a link farm, which is a common tactic for SEO manipulation or phishing. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the presence of numerous external URLs suggests the document is designed to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9776

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=adenocarcinoma+de+cuello+uterino+pdf
    • https://cdn.sqhk.co/nurijodefa/idjdJuD/the_last_door_walkthrough_chapter_4.pdf
    • https://cdn-cms.f-static.net/uploads/4483587/normal_6043f340ecb18.pdf
    • https://telozigigozato.weebly.com/uploads/1/3/4/3/134310186/wezerimexozilot.pdf
    • https://cdn-cms.f-static.net/uploads/4414489/normal_604b8029b3e83.pdf
    • https://cdn-cms.f-static.net/uploads/4455902/normal_601f0e163030f.pdf
    • http://rusakadovub.sportsontheweb.net/wipefarodutepafafefoxi.pdf
    • https://cdn.sqhk.co/jabisopomuxo/hgeiahh/zoxogerobibe.pdf
    • https://ledobosu.weebly.com/uploads/1/3/1/3/131383424/bebofit.pdf
    • https://kiwaluraxipexe.weebly.com/uploads/1/3/5/3/135326690/renip.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://27475d5a-2981-497d-8cd5-0c310ef10f8b.filesusr.com/ugd/9cb927_2ed745cf534a48d98a13555883b2d860.pdf?index=true
    • https://3e80c8bf-0031-4ca1-bfa9-4484641fefed.filesusr.com/ugd/08103e_3b900c85adb84c21bf74490f04f326a7.pdf?index=true
    • https://b5c90759-dbf8-4ccd-b12d-e23c958527f9.filesusr.com/ugd/915a55_ba7f55108edd424ab984bf20d31b880c.pdf?index=true
    • https://s3.amazonaws.com/fonazuzixagizir/spreadsheet_app_for_ipad_3.pdf
    • http://wejufutaz.onlinewebshop.net/83006977413.pdf
    • https://s3.amazonaws.com/bokofapig/can_you_mod_fallout_4_on_xbox_one.pdf
    • https://9f349447-249b-4747-956a-316fe86e371b.filesusr.com/ugd/d2b720_06061052aca94f248118f09040df626b.pdf?index=true
    • https://s3.amazonaws.com/fidefofudi/apple_email_not_working_on_android.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f885.bin
01c0b7c8e350f1a544b2772c1839a4c8194cdf1d3bf9d42847d22355bc88bfe9
pdf-font-stream PDF embedded font (sfnt) at offset 0xF885 5112 bytes
font_01_sfnt_off000109d6.bin
175c126881a7d5c212fb179af27c3cfddd09ebccfae23f9ea9213399c15c9aec
pdf-font-stream PDF embedded font (sfnt) at offset 0x109D6 11480 bytes