Malicious PDF — malware analysis report

Static analysis result for SHA-256 f973863ecfa34723…

MALICIOUS

PDF

76.4 KB Created: 2021-04-01 23:10:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: db48b4fa6e59b80165a3ba3d83153ed0 SHA-1: d9b14d8beb87141bbe2a28961e9b4b951d001596 SHA-256: f973863ecfa34723ffd427b20422412ba35b3ba0b7753f5fecf7cb840c32e5d2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm or SEO manipulation scheme. One of the extracted URLs, 'https://druttle.ru/award?keyword=after+death+comic+pdf', appears to be the primary lure. No scripts were extracted, but the PDF structure itself is used to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=after+death+comic+pdf
    • https://cdn.sqhk.co/lelogivotosu/czeia1x/wezixivu.pdf
    • https://cdn.sqhk.co/gabunufu/dqcZc55/3d_wedding_cake_design_online.pdf
    • https://cdn.sqhk.co/sirijunubi/u3Kqgea/javubowilanutosokij.pdf
    • https://cdn.sqhk.co/baxotonad/dicijjd/bmcc_portal_not_working.pdf
    • https://cdn.sqhk.co/pefisemise/e6Jvzic/kpop_piano_games_music_color_tiles_mod_apk.pdf
    • https://cdn.sqhk.co/konosoka/kvhXUid/veremamebedubuwuvapo.pdf
    • https://cdn.sqhk.co/naziwixolagu/YNl1fjd/modern_girl_outfits.pdf
    • https://cdn.sqhk.co/jimumakevaji/hewjiii/30239108914.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ca39e044-ba76-4326-ad1b-fe8e95ffc08c/gulugugowel.pdf
    • https://da550aaf-34ae-4f9b-ad82-7836b82beebe.filesusr.com/ugd/a203e6_8efe3e744725460ab389c31ecafde405.pdf?index=true
    • https://7d33af4c-acfd-4996-9436-348e89828b5b.filesusr.com/ugd/289672_61c5f0df42c542649c818d9be4a33659.pdf?index=true
    • https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_c92026a4e3c24797af66ef5f086ea03f.pdf?index=true
    • https://cc6d8859-fc08-4100-a073-55b48c5addfc.filesusr.com/ugd/238140_9cc86414c0b24d1a84c09daed6d4d1bd.pdf?index=true
    • https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_80f4dcc11d604d159e4f0c4fe1763f2e.pdf?index=true
    • https://a50dbba5-e4fd-40cc-afa9-a45495a5accf.filesusr.com/ugd/7f929b_6e754d1a804c47b9ba5325e9ae7afd32.pdf?index=true
    • https://37523d11-79cf-4eb3-ada4-f05de57c71ee.filesusr.com/ugd/275374_2dfc707114594ba4979b3d32560ade79.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1d5d3981-b4b1-43a8-aee3-5bfbaa3f3cb8/legowu.pdf
    • https://uploads.strikinglycdn.com/files/b2bc0b1c-5d18-4497-bb82-81b21f5f977d/5171166779.pdf
    • https://uploads.strikinglycdn.com/files/81a671d0-37d4-4aea-9c0a-4baf185c4924/how_to_speak_english_simple_sentence.pdf
    • https://00e6f838-d17c-4130-b616-1adf5f4d9bb3.filesusr.com/ugd/714321_757a537480714344b68f33921b31ae0a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eed2.bin
dcfd5903b14acc0a5cda593dbad461ac8c5ba7fa2e38a05ceb626f35d89fe5ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEED2 5176 bytes
font_01_sfnt_off00010048.bin
683b9b15289706745672f09ccac4f6dfce5bc0cb41f6e645c77032e2cd2eab3f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10048 10156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.