Malicious PDF — malware analysis report

Static analysis result for SHA-256 10f95e38680f62ee…

MALICIOUS

PDF

136.8 KB Created: 2021-03-14 19:56:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a0ad65ac7bc27deb9228c0f1890ad754 SHA-1: e63b55e4b14a4def012de0815bc78baf9eccf7c3 SHA-256: 10f95e38680f62ee20eb10fe8399ce4065e42130b11cb39ca5de3f5fd58d1bd4
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of an advance-fee scam. It contains a mass of external links, with the primary malicious URL being https://vilenefex.ru/strik?utm_term=manual+de+citizen+eco+drive+calibre+8700+gold. The document's structure and content suggest it is designed to trick users into clicking malicious links under the guise of providing a product manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=manual+de+citizen+eco+drive+calibre+8700+gold
    • https://cdn-cms.f-static.net/uploads/4380219/normal_600a9470927dc.pdf
    • https://lotaximadezepa.weebly.com/uploads/1/3/1/3/131379514/412745.pdf
    • http://gbo.guru/610457207325hw8v.pdf
    • https://puxipevabama.weebly.com/uploads/1/3/4/3/134308905/a2abbe.pdf
    • http://www19216801.site/cost_reconciliation_statement_formattq124.pdf
    • https://static.s123-cdn-static.com/uploads/4380692/normal_5fcd284acd4aa.pdf
    • https://gawotajar.weebly.com/uploads/1/3/4/5/134525297/mavoniwenefasokidap.pdf
    • https://cdn-cms.f-static.net/uploads/4419410/normal_600baf3bf3185.pdf
    • https://jomagikovire.weebly.com/uploads/1/3/1/4/131408086/ponixudap.pdf
    • https://cdn-cms.f-static.net/uploads/4491934/normal_5fda39bb95e36.pdf
    • http://arm-watch1.club/16028161048aqtm8.pdf
    • https://xejevegufukax.weebly.com/uploads/1/3/0/9/130969627/futipumidivuge_nasebokesin_mokok_nexetumovutixab.pdf
    • http://relax35.ru/61743368339zt2fe.pdf
    • https://static.s123-cdn-static.com/uploads/4422643/normal_5fed1cc3d515c.pdf
    • http://hookup681.site/869544252194tkc5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d8ec1991-fa5a-4fbc-bfd2-2cd05fbaa174/sagaxasixibezujow.pdf
    • https://e9b66cc5-9289-431c-8f17-6739e1cd2d88.filesusr.com/ugd/c8f33b_dd7e94029e684af2a9e446940ef56cb6.pdf?index=true
    • https://e25b7b56-d8f7-44cb-9276-56428e53d1cc.filesusr.com/ugd/63f3e8_e5d7731fd79345a598c21aeeb1f9d1d3.pdf?index=true
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_50c3e200f26843e78a8c5d219b2b47e3.pdf?index=true
    • https://5071cc05-3fa2-46b1-b944-d2523ca4b51d.filesusr.com/ugd/62e2c1_b2250cba6f7b4bf3818165559c7195bf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/32d415f3-8a29-4dd9-89b3-94908ce23f61/ancient_christian_commentary_on_scripture_john.pdf
    • https://11fe2947-f393-4df3-905d-f9f3730e834a.filesusr.com/ugd/b1b16e_2d7c55e7eb4f43e788e5911367624348.pdf?index=true
    • https://23751d96-d7b3-42ca-b8ca-e459b671ea95.filesusr.com/ugd/7de994_b5c65fc3299b48d8a318efe1bf1485f0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1c595cf6-7cc1-4f47-92f7-4da8846ef200/can_you_buy_an_ar_15_in_virginia.pdf
    • https://uploads.strikinglycdn.com/files/352186fc-8e51-4880-9d95-95ba2e3107ba/tokyo_ghoul_season_3_theme_song_lyrics.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001db1a.bin
ca919e844c8f1e572b6de94a0af480ebe5091670a33b4649384aecaee42ef08e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DB1A 5600 bytes
font_01_sfnt_off0001ee57.bin
90d47d5c5218a4e535aecffcd311ea326b479815d3deb3ae959dfaa3c5628a96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1EE57 11304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.