Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffd019a80c5e4cdc…

MALICIOUS

PDF

77.6 KB Created: 2021-06-09 04:39:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58fb15e24e58f874ff285df7ee4dc9a3 SHA-1: ad51ab5f87a1145de67e86adfbd82f80673fcaff SHA-256: ffd019a80c5e4cdc5d4c14d8403a9fa545274fd44786411c77f60b6f09325c88
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, suggesting it's part of a link farm or SEO spam operation, with one primary URL being https://medvor.ru/pbw. While no scripts were explicitly extracted, the PDF structure and heuristic firings point towards malicious intent, likely to redirect users to malicious or spam content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=present+simple+exercises+pdf+for+kids
    • https://tuxenovizomojow.weebly.com/uploads/1/3/7/5/137516496/kalefaka-nuvananosowe.pdf
    • https://rivakevalitute.weebly.com/uploads/1/3/0/8/130813818/bogerudeworele.pdf
    • https://patufefuwo.weebly.com/uploads/1/3/4/3/134312622/eddd58671a.pdf
    • https://dijasajud.weebly.com/uploads/1/3/4/7/134701723/5b955c00e42ca2b.pdf
    • https://lorujuxivole.weebly.com/uploads/1/3/4/5/134595667/79118.pdf
    • https://duveniwapawas.weebly.com/uploads/1/3/4/2/134265961/vodumiwufeg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/94c191e2-6fc9-4f31-9219-9b63fc54b42a/cuantos_cm_son_5_pulgadas.pdf
    • https://uploads.strikinglycdn.com/files/215fb4ba-3327-4035-99e2-e7ff79d477ad/duwowesowiwi.pdf
    • https://uploads.strikinglycdn.com/files/40214d64-dadc-4a71-b04e-51a6ab41e1db/tom_clancys_rainbow_six_siege_-_deluxe_edition_vs_standard.pdf
    • https://uploads.strikinglycdn.com/files/e1abf1eb-893d-4d7a-9cb5-6f539eccf0d3/all_physics_formulas_download_gcse.pdf
    • https://uploads.strikinglycdn.com/files/d0935b94-0c57-4c13-8085-f5b73d303fb1/83661838920.pdf
    • http://zajozote.pbworks.com/w/file/fetch/144439203/biologia_general_de_curtis.pdf
    • https://uploads.strikinglycdn.com/files/0b64fa06-ca19-44f2-955f-f0fb7ecd1a3e/those_who_wait_on_the_lord_song.pdf
    • https://uploads.strikinglycdn.com/files/92143b55-3c09-4af1-9dc2-b06b88e343b9/87246296307.pdf
    • http://jeveriwilum.pbworks.com/w/file/fetch/144599289/thomas_calculus_12th_edition_solution_chapter_3.pdf
    • https://uploads.strikinglycdn.com/files/ca3cebd0-8b5f-4d1d-94b8-1d8ecf623f7e/green_light_rochester_ny.pdf
    • https://uploads.strikinglycdn.com/files/5e4b6b73-f985-4ea5-881f-950b741a221a/rakukunazufajezomalodoj.pdf
    • http://magogopowo.pbworks.com/f/adobe_illustrator_cs5_crack_version_free_download.pdf
    • http://gudikijuruf.pbworks.com/w/file/fetch/144471084/piwokilumoteduj.pdf
    • http://fokojifidesi.pbworks.com/w/file/fetch/144505809/35925645869.pdf
    • https://uploads.strikinglycdn.com/files/f3409835-bded-4855-a56f-ff2fde687c47/junasaridino.pdf
    • https://uploads.strikinglycdn.com/files/d0074c14-51d3-4424-b683-c0a5d5fcd478/saeco_royal_coffee_machine_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/02e848e8-4566-4abc-87ca-7cec75f9c8bf/who_is_the_most_powerful_god_in_egypt.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4d3.bin
2662063a43a84580c4c7e6ea68f1ad88b5949d0a06fa9ffbaa841ed47ad52422		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4D3 5012 bytes
font_01_sfnt_off0000f5c2.bin
e17bf3db314cbd555a787754492473479a669b66f340eb4ee8aed26d58469ca4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5C2 10240 bytes
font_02_sfnt_off000118c9.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118C9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.