Malicious PDF — malware analysis report

Static analysis result for SHA-256 13e3f71bcc3501ec…

MALICIOUS

PDF

78.8 KB Created: 2021-04-01 19:00:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0ace2ef7ffa3035cd5023ddc408a0f31 SHA-1: 7b496b576392db3761e716a418df01f8c874d93a SHA-256: 13e3f71bcc3501ec6e9924b8317a97d9401aa0e3efe8b9583197d52b973b5a82
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. The heuristic firings reveal it contains a large number of external links, suggesting it functions as a link farm. One of the embedded URLs, 'https://vilenefex.ru/strik?utm_term=should+you+wash+your+face+after+exercise', is particularly suspicious and likely leads to a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=should+you+wash+your+face+after+exercise
    • http://opsnatur.fun/practical_skills_in_chemistry_3rd_editionium6g.pdf
    • https://pagazamis.weebly.com/uploads/1/3/5/3/135310118/fugawejito-watakukawi.pdf
    • https://fawurefo.weebly.com/uploads/1/3/4/4/134441885/5672485.pdf
    • http://dujegud.getenjoyment.net/95169352589.pdf
    • https://fiwofufoneronup.weebly.com/uploads/1/3/1/0/131071066/lopakemisome.pdf
    • http://jevutodirawis.iblogger.org/gusogolikodubuganowivimaw.pdf
    • http://copyrightnotice-ig.com/govojumejrkzni.pdf
    • http://xakidofe.sportsontheweb.net/96881158413.pdf
    • http://prolac.ru/latest_pokemon_game_for_android_freeuv4qp.pdf
    • http://return-0.com/photosynthesis_lesson_planzua38.pdf
    • https://jetisinodab.weebly.com/uploads/1/3/5/3/135335938/26090.pdf
    • https://bulejoge.weebly.com/uploads/1/3/0/7/130775594/9dfee4ef33fcb5f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ferodibev.onlinewebshop.net/90944381855.pdf
    • https://4c5ad993-366d-4b3a-aa99-9b6f56583180.filesusr.com/ugd/01e791_954a2fc831ca45fe85ae7639872171df.pdf?index=true
    • https://48bf584d-d56c-45cf-b4f3-c1c05dce5274.filesusr.com/ugd/3f4b99_71fe19ecdab64022ab6265560c4190ce.pdf?index=true
    • https://c2093f15-f4fb-4bda-9582-db5404103fa6.filesusr.com/ugd/b28561_b8b06ac0bd8f45f8a4fd95b2f2f42d03.pdf?index=true
    • https://8ab1a2d5-e5b1-44c5-a28c-e09959565f0d.filesusr.com/ugd/eb712c_810cbab82bf04b37add0c8c2716b5fa7.pdf?index=true
    • http://ginowane.onlinewebshop.net/66451320812.pdf
    • http://timarofata.epizy.com/shadowrun_hong_kong_class_guide.pdf
    • https://1ba6f066-89d4-4445-b8a9-08a6de046ef2.filesusr.com/ugd/d40554_de5aceaa95024a2590f85f81d321dfb6.pdf?index=true
    • https://8e0cabef-d481-4215-b437-8a5fc4e4723c.filesusr.com/ugd/f41140_1775f3c7fec140baaca179e4a74f1f5f.pdf?index=true
    • http://sufelubunat.epizy.com/ludatered.pdf
    • http://widusop.atwebpages.com/22921287624.pdf
    • http://pixudavevenute.rf.gd/jobativuxuzegitob.pdf
    • https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_017dfad6adc8429aa2dd317a1b5f37ac.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1f0.bin
4124be45448284fe582bbd2a6e8bd91fb61adc298bbe2bef9774206c96ff50b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F0 5472 bytes
font_01_sfnt_off000104a5.bin
04489d8377301b05e69829cfa738902f1ccb738f6f8e563cb0f616a3ebd8fe87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104A5 11388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.