Malicious PDF — malware analysis report

Static analysis result for SHA-256 f21f0d72b1c7d1ad…

MALICIOUS

PDF

74.1 KB Created: 2021-03-19 05:42:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 35be84368b58adc03f27080f3d73ec40 SHA-1: 247639ebbb497e1faf328686fc44e3aa74cd07e8 SHA-256: f21f0d72b1c7d1ad3bd02f6b64ff352aa1b7394c6fce6e5e8f24c3a2a5e999d8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file identified as malicious by multiple heuristics and a machine learning classifier. It contains a large number of external links, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://dafemum.ru/123?utm_term=apocalypto+movie+english+subtitles, which is likely used to redirect users to malicious content. No scripts were extracted, but the PDF structure and link farm heuristic indicate a malicious intent to direct users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=apocalypto+movie+english+subtitles
    • https://muzifadisuluso.weebly.com/uploads/1/3/5/3/135347683/rezew.pdf
    • https://bikonate.weebly.com/uploads/1/3/4/7/134715396/8769471.pdf
    • https://sotugipuzelaj.weebly.com/uploads/1/3/0/7/130738723/vefajulodela_rilakafixizabo_wapaderem.pdf
    • https://goguribepolim.weebly.com/uploads/1/3/0/7/130739596/55f56b6ff61.pdf
    • https://severuzilun.weebly.com/uploads/1/3/4/7/134710190/2235981.pdf
    • https://tenabawik.weebly.com/uploads/1/3/2/7/132710661/dogereretemik_loxege_zulixor_tufikad.pdf
    • http://sunny-web.ru/can_hormones_affect_thyroid_function6v3f2.pdf
    • https://vujilesozigo.weebly.com/uploads/1/3/4/0/134042384/3441e.pdf
    • http://raicen.com/pixerireneslq12.pdf
    • https://gavokafiwafez.weebly.com/uploads/1/3/1/3/131381231/dabopebu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b8607764-5f8f-4e6f-9772-a74c406b998f/shakespeare_sonnet_116_summary.pdf
    • http://gobobanowis.epizy.com/powerbroker_password_safe_api_guide.pdf
    • https://uploads.strikinglycdn.com/files/93bd5caa-a9dc-43c9-ae1c-010c405489d9/the_power_movie_review_in_hindi.pdf
    • http://paravewufazik.epizy.com/apache_tomcat_7_for_ubuntu_16._04.pdf
    • https://uploads.strikinglycdn.com/files/ef63b95d-ece0-4813-b92e-78b8624e8ee2/is_tzatziki_sauce_low_carb.pdf
    • https://uploads.strikinglycdn.com/files/648eebbb-89e0-4dbd-9d69-0a2d7265b038/lightstream_suntrust_auto_loan_overnight_payoff_address.pdf
    • https://uploads.strikinglycdn.com/files/90711edf-2fad-4efa-8ee0-19ffe882a23d/crossbow_plans_pattern.pdf
    • http://nozewupipomog.epizy.com/lifepufulejudopejafa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf38.bin
b4661435bbbf3577c2a13069f695a6a3963cf2d2afc3b494bd21ca632d59a63c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF38 5540 bytes
font_01_sfnt_off0000e1fb.bin
b5c9f5a4c93500177d1704c083d71fb11d9cc9b754c7b51aaa2557948a5c117a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1FB 10600 bytes
font_02_sfnt_off000105d4.bin
541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105D4 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.