Malicious PDF — malware analysis report

Static analysis result for SHA-256 fabda50fe00ec2c7…

MALICIOUS

PDF

107.8 KB Created: 2021-03-25 15:32:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f2f46b54c99b6422e58429d1ecdb35f2 SHA-1: 62cda9df9da345d1e5770b29cc0cf7dcdb2df37c SHA-256: fabda50fe00ec2c7df748f127e33271ac50b85f5f965ddb9b061e525bd994e3b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The primary external URI points to 'fokemale.ru', and numerous other Weebly-hosted PDFs are present, suggesting a link-farming or redirection scheme. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the link farm indicate a malicious intent to direct users to potentially harmful content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8624

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=bac+international+maroc+cours+physique+pdf
    • https://risegexof.weebly.com/uploads/1/3/4/6/134661868/00852ce.pdf
    • https://cdn-cms.f-static.net/uploads/4450418/normal_60584d25d22fb.pdf
    • https://temisufe.weebly.com/uploads/1/3/5/3/135384001/ca2d645aa12f.pdf
    • http://bio-ita.fun/zegutumudifukuzipomojwic4.pdf
    • https://vadalafazewa.weebly.com/uploads/1/3/4/8/134897988/nixofonajutoxosog.pdf
    • https://wulafuxuzezam.weebly.com/uploads/1/3/2/3/132302924/7b9d65379.pdf
    • https://sujefamop.weebly.com/uploads/1/3/4/7/134762109/setodawaweme_pifipa.pdf
    • http://evromotors.net/wonumogudizijazujefupike12056.pdf
    • http://reassurez-moi-fr.info/31527194192b3a5d.pdf
    • https://cdn-cms.f-static.net/uploads/4499334/normal_6049e70983e4e.pdf
    • http://gayerkan.com/what_types_of_termites_are_in_connecticutn3g9w.pdf
    • https://verosogoteri.weebly.com/uploads/1/3/4/7/134738646/ed681a95.pdf
    • http://closemaze.com/66450879446xy8yr.pdf
    • https://cdn-cms.f-static.net/uploads/4469626/normal_6026f75ea71b9.pdf
    • http://baugroup.info/4522314950876z44.pdf
    • https://sudewivozuv.weebly.com/uploads/1/3/2/3/132303071/3506591.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://3cde87c3-25ab-478b-b58d-ba072f1c7540.filesusr.com/ugd/255d97_866e0a2f59dc42b09b73364607147adf.pdf?index=true
    • https://689a2394-1721-4ce0-b6f7-af9f1dc0d621.filesusr.com/ugd/0f5b72_ffd475d1266a47abb4d3eedb1b307a56.pdf?index=true
    • https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_0fc5344743ad4661bc42e64ddf292918.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012011.bin
ab7640f983d0cce9d970d68365cfa90246408aee69706890ed4ad143ed3577c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12011 24136 bytes
font_01_sfnt_off00016bff.bin
b8f6bc37935c6dfef967174bedc4b8fb3cf89ded817f02fb1082833531610018		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16BFF 5672 bytes
font_02_sfnt_off00017f23.bin
9c13e2928ce10bfb7f6556991a295dddf2d41997a28b12e7dc3e5855f8367e17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17F23 12636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.