Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd6ed304a00ffe82…

MALICIOUS

PDF

73.6 KB Created: 2021-06-07 15:47:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 573e3fa909db159a6bd9fcfaf8fc5ba1 SHA-1: 6b6f99af8dda5d44d4027d8c271fa5149508ef32 SHA-256: fd6ed304a00ffe828061aaf75712b09236492cafc90e37e698d9c42704f5c5b1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with one prominent URL being https://queure.ru/pbw?utm_term=curt+bergfors+net+worth. This suggests the document is designed to redirect users to potentially harmful websites, possibly for phishing or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=curt+bergfors+net+worth
    • https://cdn-cms.f-static.net/uploads/4423752/normal_605c48287a2f7.pdf
    • https://cdn-cms.f-static.net/uploads/4393626/normal_606ea54980811.pdf
    • https://towelekuw.weebly.com/uploads/1/3/1/4/131406253/716182.pdf
    • https://cdn-cms.f-static.net/uploads/4371258/normal_605eeb0048a6c.pdf
    • https://xuratofojiwob.weebly.com/uploads/1/3/4/0/134096374/jenaxukutulepim.pdf
    • https://xasugalepo.weebly.com/uploads/1/3/4/3/134311154/gamituwon_ruxixekuf_wulobe_vedugenodon.pdf
    • https://wemoloxemud.weebly.com/uploads/1/3/4/6/134603697/3759551.pdf
    • https://cdn-cms.f-static.net/uploads/4404113/normal_60bddcb66906f.pdf
    • https://cdn-cms.f-static.net/uploads/4380883/normal_5fd7a6dc52def.pdf
    • https://static.s123-cdn-static.com/uploads/4405642/normal_5ff6561c1d502.pdf
    • https://cdn-cms.f-static.net/uploads/4478928/normal_6054f9eb5d2b3.pdf
    • https://cdn-cms.f-static.net/uploads/4377679/normal_606ea2f4535bc.pdf
    • https://xipakopubax.weebly.com/uploads/1/3/5/9/135966228/81713ed789.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/87772e93-bcf7-4983-bfbb-95ce38b73539/numeros_divisores_de_1224.pdf
    • https://uploads.strikinglycdn.com/files/06e067dc-4ce7-47ce-a0ec-4f798dc0954b/lezeda.pdf
    • https://uploads.strikinglycdn.com/files/21fe48dc-9430-46ed-995e-ef7ae0cc2814/74262699459.pdf
    • https://uploads.strikinglycdn.com/files/a5e590c1-025a-4639-b5f0-9540b0c92de8/6277900143.pdf
    • https://uploads.strikinglycdn.com/files/69d59f93-230a-45c8-8cae-072d79d4d07a/kupizo.pdf
    • https://uploads.strikinglycdn.com/files/37fe5915-9cdd-4d9f-839c-b40428a46e7e/how_to_write_a_business_writing_sample.pdf
    • https://uploads.strikinglycdn.com/files/7f54fac6-2741-4f0b-98bd-b5d3b006e0dd/how_much_does_navy_federal_pay.pdf
    • https://uploads.strikinglycdn.com/files/38ed29f0-9178-4c3b-8161-f6a10400091a/optimate_4_dual_program_battery_charger.pdf
    • https://uploads.strikinglycdn.com/files/4dd67ded-0f12-47c7-a0e1-206efcdd6582/design_thinking_stanford_coursera.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e033.bin
547e52752ddcab16fac9c0ef6c4b9b8eed4f5249905fe5707de74ee529746ba4
pdf-font-stream PDF embedded font (sfnt) at offset 0xE033 4924 bytes
font_01_sfnt_off0000f10b.bin
076f67e7e3e704f984690b0b4505842118c14947c68b38bd12ca96640f5e8b2c
pdf-font-stream PDF embedded font (sfnt) at offset 0xF10B 12148 bytes