Malicious PDF — malware analysis report

Static analysis result for SHA-256 0950c9903af17921…

MALICIOUS

PDF

73.0 KB Created: 2021-03-20 12:05:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18d00d13f4944117e116e1e40324458d SHA-1: 706126d7f288cd37569cc2b7fb90578dad88a4ef SHA-256: 0950c9903af17921884e21812811fd7852e9be73d2cea623b0150a0762c1ad97
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are generated SEO-style links pointing to other PDFs. The primary URL, 'https://xezojetit.ru/wix?keyword=sears+craftsman+lawn+mower+manual', suggests a lure to a potentially malicious site disguised as a manual search result. ClamAV detection and ML classification strongly indicate malicious intent, likely related to phishing or SEO spam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=sears+craftsman+lawn+mower+manual
    • https://wukodotimage.weebly.com/uploads/1/3/4/4/134487216/19c2b53edf.pdf
    • https://cdn-cms.f-static.net/uploads/4488809/normal_60435574f1a5d.pdf
    • https://cdn-cms.f-static.net/uploads/4459320/normal_601554f880f03.pdf
    • https://vabeliguteziji.weebly.com/uploads/1/3/1/3/131379360/e5107c.pdf
    • http://bekulosokoj.iblogger.org/derazuzilenejapakexi.pdf
    • https://cdn-cms.f-static.net/uploads/4412378/normal_60406a588731d.pdf
    • http://nigasheff.xyz/cheltenham_condensed_font_freeepmv9.pdf
    • https://bupulaserora.weebly.com/uploads/1/3/1/4/131437689/xigewa-mewekan-bofedamat.pdf
    • http://baranaydin.org/52356560065nkl36.pdf
    • https://cdn-cms.f-static.net/uploads/4473619/normal_601d26c72846f.pdf
    • http://zavupefedeba.22web.org/lonely_planet_guides_australia.pdf
    • https://venubitolaxi.weebly.com/uploads/1/3/4/3/134372432/6602921.pdf
    • https://cdn-cms.f-static.net/uploads/4500679/normal_6026012fa3216.pdf
    • http://uabiomanix.xyz/aqua_pure_water_softener_partsp8zxb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jinonepi.epizy.com/setting_of_thank_you_maam.pdf
    • http://venasipinizi.rf.gd/a_night_to_regret_movie.pdf
    • http://pubitawiwinas.rf.gd/rowdy_baby_song_tamil_movie.pdf
    • http://jadabizufugiba.rf.gd/fun_riddles_and_brain_teasers_with_answers.pdf
    • http://sizujuzefe.epizy.com/lonapazowedalemep.pdf
    • http://nolixegoxow.epizy.com/davutos.pdf
    • http://darozux.epizy.com/jawbone_up2_app_ios.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df10.bin
15292413035c6335ccab5335f151236b8a3670946283e4b3f5ae0e677485d583		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF10 5224 bytes
font_01_sfnt_off0000f0ce.bin
fd9a63c8ae82966ef1db4dc5399509db26252cb7401b4967d871cc25d78d0e05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0CE 11260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.