Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4cda966b3475540…

MALICIOUS

PDF

77.6 KB Created: 2021-03-15 11:22:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fcf42ae33315b613f1849f3c22b3b83c SHA-1: 2883a82c62980d03829e8151a16165b2342818de SHA-256: f4cda966b3475540c34e03e51bb4efcc9cfc5187a0e599d3cb8299db137fb929
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing or malicious link farm, as indicated by the high number of external links and the ML classifier's strong positive prediction. The embedded links, such as 'https://pelibifir.ru/strik?utm_term=crock+pot+slow+cook+setting', are likely intended to redirect users to malicious websites. The ClamAV detection further supports the malicious nature of this document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=crock+pot+slow+cook+setting
    • https://static.s123-cdn-static.com/uploads/4464715/normal_5fca0c3e56263.pdf
    • http://reduslimitaly-official.site/invaders_from_the_planet_moolah_jackpotj0o8g.pdf
    • https://cdn-cms.f-static.net/uploads/4449783/normal_6031d7cd852f9.pdf
    • https://cdn-cms.f-static.net/uploads/4411696/normal_603c7cb303bc8.pdf
    • https://cdn-cms.f-static.net/uploads/4421624/normal_603bc5d61cc84.pdf
    • https://cdn-cms.f-static.net/uploads/4381081/normal_601eb2ba8b94d.pdf
    • http://trenolgia.buzz/kubota_d722_service_manual_downloadlhn4l.pdf
    • http://silkhfig.bid/does_ps5_have_60fps9z579.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_52cca317ec644b239ff390aba0fea937.pdf?index=true
    • https://s3.amazonaws.com/gaxuremewuger/android_backup_messages_and_call_log.pdf
    • https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_f05eedcb0efb4fd8a268c603db6a6db0.pdf?index=true
    • https://s3.amazonaws.com/gofilafixu/loradokobabapajupuj.pdf
    • https://uploads.strikinglycdn.com/files/1dc5272c-c6ca-4c7c-8a26-f6741fab5e81/how_do_i_reset_my_thermometer.pdf
    • https://s3.amazonaws.com/bitajemisajoz/how_to_practice_wing_chun_without_a_dummy.pdf
    • https://uploads.strikinglycdn.com/files/acb7c290-bfbb-451e-887b-a805900bb500/71491163572.pdf
    • https://s3.amazonaws.com/dazinibonofobi/twin_bed_sheets_walmart.pdf
    • https://uploads.strikinglycdn.com/files/2ed955c9-a57e-4515-a208-0103482d90a2/petab.pdf
    • https://uploads.strikinglycdn.com/files/3b3399b7-200d-42ef-a255-d9c31ba4979f/note_speller_worksheets_answers.pdf
    • https://s3.amazonaws.com/sonutopexaramuf/56162756548.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f05d.bin
92364ec117daf468bca80462d9b49dd471f1e089adcfcdb9b2440fca8613b4a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF05D 4952 bytes
font_01_sfnt_off00010162.bin
571a29523ec3c75cccc72ba1fa6fc02b5d83aeca160dfc5dc2ebfeb30705a933		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10162 11308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.