Malicious PDF — malware analysis report

Static analysis result for SHA-256 12ec7207ee125770…

MALICIOUS

PDF

77.0 KB Created: 2021-03-30 15:06:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 7ded03bbd246d2a2a97c542f5235af31 SHA-1: f2e5a4a5eabedaad00587b8052f6ba6e564bce3a SHA-256: 12ec7207ee125770922fe65d84870dffe5ff231427aa9c7793a6fe3f99a1f4b8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO link farms and phishing. The primary URL, 'https://jumiwimov.ru/award?keyword=calculus+of+variations+springer+pdf', suggests a phishing attempt disguised as a search result. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=calculus+of+variations+springer+pdf PDF link annotation
    • https://redulexaxoxega.weebly.com/uploads/1/3/0/8/130874010/793006.pdfIn PDF document text
    • https://boxagabopevonud.weebly.com/uploads/1/3/4/3/134353696/xiponijid.pdfIn PDF document text
    • https://wuwonerosetopux.weebly.com/uploads/1/3/1/6/131606808/liruwuvijanugazod.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_432a163c09b74536b91ac5ef739f0ceb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/96742b60-0e24-4bbb-ad1b-94c4bb92bd08/do_you_need_to_use_honda_transmission_fluid.pdfIn PDF document text
    • https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_b2fd75372945429d903a7555d24c0811.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/63695689825.pdfIn PDF document text
    • https://s3.amazonaws.com/fejakixoweka/business_woman_cartoon_vector_free.pdfIn PDF document text
    • https://s3.amazonaws.com/nijosinizo/what_size_battery_for_john_deere_riding_mower.pdfIn PDF document text
    • https://1639490a-f715-481e-9fb1-af38d332269b.filesusr.com/ugd/a59130_61d0e1f1c2f34f75a2cf2b1cbe6cc67c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wotodedaruzuk/24822728331.pdfIn PDF document text
    • https://s3.amazonaws.com/domegagowevag/toxovor.pdfIn PDF document text
    • https://b46c4cda-4951-41c0-816f-bbf02eee4d9b.filesusr.com/ugd/4ff992_f5ced3ed2c1c482eac230c9765b79ce3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/economic_liberalization_in_nepal.pdfIn PDF document text
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_3038410147904852821c55e5ff9159aa.pdf?index=trueIn PDF document text
    • https://557345b1-98c6-442d-b460-9e357c178e5b.filesusr.com/ugd/dfb5f8_2a4cbde8eacd4175b016b2ccf609a6fb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vutame/gukamenoxasazapuku.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc063c1c-1cd2-4add-8f6b-346f07147889/ziwalodelu.pdfIn PDF document text
    • https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_0642a7ef89ba4643b4a21bfbb7bb8997.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mawesenasijoser/jacplus_psychology_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bbe9c50-07db-4e76-8335-43b135418212/where_can_i_exchange_soda_stream_cannisters.pdfIn PDF document text
    • https://b354d503-40d1-4c97-84b4-bc0b16c12f35.filesusr.com/ugd/8c7d07_63a4389b2ca64c46b2d35e0d812f147f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED76 5288 bytes
SHA-256: f8c2f9e5937c5089c480e3b16b08dea8274a8cf155e9e4b6337c8ba35d15a647
font_01_sfnt_off0000ff85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF85 11044 bytes
SHA-256: 9734c16613294d90ebad2f86f26b445a97fd8782e0cdac05041d6a06ada3a951

Open this report in the interactive analyzer, or submit your own file for analysis.