Malicious PDF — malware analysis report

Static analysis result for SHA-256 03ec91cceefcf678…

MALICIOUS

PDF

71.6 KB Created: 2021-05-11 23:32:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e7d9d0c99a1f8895ef1225e31cfeccf SHA-1: 70a661a5671602e5014078fb7b7586d19f6efd7d SHA-256: 03ec91cceefcf678112daacf494318445c6a2ee3142f0f370e7c40cc23ca9d3d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are hosted on Weebly and appear to be part of a link farm designed to mimic search results. The primary URL, 'https://leonvi.ru/strik?utm_term=truist+bank+columbus+ohio', suggests a phishing lure related to banking information. While no scripts were explicitly extracted, the PDF structure and extensive link farm indicate a malicious intent to redirect users to potentially harmful sites, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=truist+bank+columbus+ohio
    • https://wanowozuvigamo.weebly.com/uploads/1/3/0/7/130738859/25ff439bc.pdf
    • https://zokukomusisitu.weebly.com/uploads/1/3/5/3/135323242/lipopuxufufep.pdf
    • https://kufidadifijerid.weebly.com/uploads/1/3/1/4/131407945/renire_sesufeg.pdf
    • https://damupose.weebly.com/uploads/1/3/1/0/131070457/tajurevobezuvijajiko.pdf
    • http://mokemowowove.mygamesonline.org/kegakudenuxug.pdf
    • https://natitapa.weebly.com/uploads/1/3/1/3/131379406/fe42ccd4683335.pdf
    • https://nagiwudulowep.weebly.com/uploads/1/3/0/7/130775657/tifovagekawogiz_takek_sexizilinawude.pdf
    • http://nemugub.mywebcommunity.org/beginner_bodybuilder_diet.pdf
    • https://denafeferigo.weebly.com/uploads/1/3/0/8/130874231/5665001.pdf
    • https://pivuwexigika.weebly.com/uploads/1/3/4/3/134320842/dagaminazara.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://padusij.onlinewebshop.net/hidden_secrets_of_the_bible_history_channel.pdf
    • https://uploads.strikinglycdn.com/files/f30c9a92-c1f2-4fe5-8060-76e711aaa2ac/zinisowizowiw.pdf
    • https://s3.amazonaws.com/legenapi/39782999624.pdf
    • https://uploads.strikinglycdn.com/files/bb101985-0711-4c9d-8769-3089d4ad0302/bipejokozu.pdf
    • https://s3.amazonaws.com/topipovikapari/fuvazid.pdf
    • https://s3.amazonaws.com/tanikanaw/geliwofukaxemesikenumogo.pdf
    • https://uploads.strikinglycdn.com/files/561308fd-ac89-4b83-9911-0044f89f209a/international_bpo_interview_questions_and_answers_for_freshers.pdf
    • https://s3.amazonaws.com/pusolefosex/can_you_learn_korean_on_your_own.pdf
    • https://uploads.strikinglycdn.com/files/f741f0bd-4663-4a7e-9861-657aad534c22/in_the_woods_tana_french_summary.pdf
    • https://uploads.strikinglycdn.com/files/516dbc11-6bf6-42e6-acbe-bc0a2bb3ee44/julian_of_norwich_body_prayer.pdf
    • https://uploads.strikinglycdn.com/files/503989f4-6f02-4cef-acf6-a0114ed3be0b/oracle_19c_v_views.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d980.bin
2c5a0a62521cbfcbb863a216f563d9af84101bf07a10d1b96692930ff73cbbd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD980 5192 bytes
font_01_sfnt_off0000eb04.bin
cd502f6d9541d725e562e0efd695ea0dd8c07f194f71ee55219c27c86fa6d7a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB04 11068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.