Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd1011c1c8ec41dd…

MALICIOUS

PDF

78.4 KB Created: 2021-03-20 13:28:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8d497e2953728aa21dcfe26d025fd688 SHA-1: eebc30a0135a9d4e9463418b96e8687450282a20 SHA-256: fd1011c1c8ec41dd1908158764a706b1b94ceabd701e68452e6e91aa773678f5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One prominent URL, 'https://maypoin.ru/award?keyword=log+and+antilog+table+pdf+file', is directly embedded and appears to be a lure. ClamAV also detected this file as 'Pdf.Phishing.Trojan'. The combination of these factors strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=log+and+antilog+table+pdf+file
    • https://cdn-cms.f-static.net/uploads/4368731/normal_602560e64d628.pdf
    • https://cdn.sqhk.co/kunimoxifagi/sjj2Aaz/zatupabuzezate.pdf
    • https://cdn-cms.f-static.net/uploads/4375509/normal_603bedeff31b8.pdf
    • https://cdn-cms.f-static.net/uploads/4484631/normal_5fe7401f33da6.pdf
    • https://cdn-cms.f-static.net/uploads/4481278/normal_603d2bba74330.pdf
    • https://cdn.sqhk.co/tesolivu/agjjehg/36276890183.pdf
    • https://static.s123-cdn-static.com/uploads/4424024/normal_5ffa522997983.pdf
    • https://cdn.sqhk.co/lexaxemiji/idTYha5/kitofuxabubiterix.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://83d7d1d1-3661-4158-a2cc-78aa4aa39d08.filesusr.com/ugd/163759_34c8b1235c6844959e866089ed4f5eae.pdf?index=true
    • https://77701ba7-c5ad-4750-ab17-5b03548f7fc0.filesusr.com/ugd/9a242c_f200176105814e4d8387bc6a778a201b.pdf?index=true
    • https://s3.amazonaws.com/rerinago/sozobudosugisam.pdf
    • https://30b7a97f-6117-4fff-8876-4b3c2220b6c6.filesusr.com/ugd/15cd4d_a47f536e7f41417f921e0982e5d441bf.pdf?index=true
    • https://72b50e20-f79f-40ca-96b4-24bef83e308f.filesusr.com/ugd/1a1092_cdf95e2cf64f43a5a8e9341464ee8d0d.pdf?index=true
    • https://3bdad275-8828-414d-9063-9532e035d791.filesusr.com/ugd/c67d0c_07adf004bef14ece92d8c09626aa0787.pdf?index=true
    • https://s3.amazonaws.com/kesumasaka/coplanar_waveguide_via_placement.pdf
    • https://86b7bb9a-6a0b-496c-a062-e8aa60c365d0.filesusr.com/ugd/dcf311_4c6880c0b3334cf1a5a594d4702d91fe.pdf?index=true
    • https://99442e0c-e188-470f-b1e9-a2082f9e7f28.filesusr.com/ugd/2274a7_782bc765d40f4f0596c5641df3721385.pdf?index=true
    • https://855e1e5b-0daf-4dce-aa73-dfad2bfec5df.filesusr.com/ugd/ced2dc_d3e8485a75ca4fd69a0aa30f556139b4.pdf?index=true
    • https://s3.amazonaws.com/kodipopujufipig/cuisinart_chw-12fr_12-cup_programmable_coffee_maker.pdf
    • https://9b321a86-0615-40a7-b684-6dced782f4cc.filesusr.com/ugd/e3cae3_b86c0c2ba41744eeb27f086b5d94706b.pdf?index=true
    • https://6db1e9a2-4282-4636-8d41-de07325ad911.filesusr.com/ugd/d97b38_98a22191bab34b44a2ff7d089753ff7e.pdf?index=true
    • https://s3.amazonaws.com/dumupa/ginilu.pdf
    • https://63b1f34b-4847-450f-8d9a-4788d10e1cf5.filesusr.com/ugd/451a43_57c7a0c3eef54bd0bebdf3e15b5bdfaa.pdf?index=true
    • https://07bd7893-a6ec-44d5-90fe-c719e602c0bd.filesusr.com/ugd/aafaff_d43a2b9ba61948a588756f244330e7d6.pdf?index=true
    • https://s3.amazonaws.com/falevi/reasons_for_carrying_out_research.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f96e.bin
576b7962cea100220b7d1358ec9c3e4eea45439686f1ee2a82ce914f4cc6d8b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF96E 5016 bytes
font_01_sfnt_off00010a99.bin
c9d77e3c0d7003fa73297acaa9c748042fbb139d6e1aad3efec1ac34c1860343		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A99 9812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.