Malicious PDF — malware analysis report

Static analysis result for SHA-256 fde536665b79c301…

MALICIOUS

PDF

77.0 KB Created: 2021-03-31 11:57:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63baff3e16dad2d36985f8206f15f022 SHA-1: b77d35e169f9b647a38bcbd463f0aa16711b4ff9 SHA-256: fde536665b79c3013431beeceb9ccd4b960dcb680eb10bc22958cb99533a8c2a
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to other PDFs, indicative of a link farm designed to distribute malicious content. The presence of a password-protected archive lure suggests an attempt to bypass security scanning. ClamAV detected this file as Pdf.Phishing.Trojan, and ML classification strongly flagged it as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=3ds+emulator+ios++no+survey
    • https://cdn-cms.f-static.net/uploads/4470040/normal_5fd34532206dc.pdf
    • https://cdn-cms.f-static.net/uploads/4495393/normal_5fd2863329542.pdf
    • https://cdn-cms.f-static.net/uploads/4473359/normal_6062ae9b62cb2.pdf
    • https://cdn-cms.f-static.net/uploads/4447108/normal_5fe9bafb167b1.pdf
    • https://cdn-cms.f-static.net/uploads/4393751/normal_602467d63f436.pdf
    • https://cdn-cms.f-static.net/uploads/4386089/normal_604f6b1168259.pdf
    • https://cdn-cms.f-static.net/uploads/4389824/normal_601f847b63d2e.pdf
    • https://cdn-cms.f-static.net/uploads/4480387/normal_600d4c6d54e6a.pdf
    • http://vowitufafuzebil.scienceontheweb.net/is_it_okay_to_microwave_chicken_nuggets.pdf
    • http://tixesikixux.mygamesonline.org/samaloja.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/gumagabu/pixadega.pdf
    • https://9fbaa0db-fe9e-443e-b503-3d02ea494c21.filesusr.com/ugd/d417e9_3a0463a126f444139f1fbc4e74759bbc.pdf?index=true
    • https://b6de9e3f-c562-4e05-b5ee-70895c8060ae.filesusr.com/ugd/3801ff_b37b4d071291462fae2ce3339e80216e.pdf?index=true
    • https://f33d1b56-f518-462b-b61f-c1b5c1ba661c.filesusr.com/ugd/1c44ce_e21e4105db1140918d12ed67dfab2faa.pdf?index=true
    • http://rewuwuja.onlinewebshop.net/tobovuwibifekitolulone.pdf
    • http://wolobugoxew.myartsonline.com/why_does_my_compressor_not_build_up_pressure.pdf
    • https://uploads.strikinglycdn.com/files/6011eecc-c32a-47ef-9773-1dc054c0dfb4/33122762260.pdf
    • https://cdd249b8-77b1-4a94-b024-8995efe4d959.filesusr.com/ugd/d394ff_4859dddc727f418396264155defe8b92.pdf?index=true
    • https://s3.amazonaws.com/wukara/excel_sheet_not_showing_2007.pdf
    • https://uploads.strikinglycdn.com/files/18f68dc2-a608-478d-9dc0-314ed7199da9/atem_1_m_e_production_studio_4k_switcher.pdf
    • http://revudipepofaten.myartsonline.com/area_sales_manager_job_description.pdf
    • https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_964c2b0332514069b2f793670de8a975.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e438.bin
f982dbbda06cc399433e1aa29bae0cdf84a43c4fdbf66e564c407c7a2a32f65e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE438 5084 bytes
font_01_sfnt_off0000f567.bin
84b1de2b6d64b8b116d166a63412b81980e3e29674708bd39042557c5d6e8f5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF567 10212 bytes
font_02_sfnt_off0001186c.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1186C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.