Malicious PDF — malware analysis report

Static analysis result for SHA-256 165a92432543e7de…

MALICIOUS

PDF

70.4 KB Created: 2021-03-31 01:51:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 8284597312227c637728ac44f4c3be10 SHA-1: fbec7519357c1f2aee0f43ad7f9a4f95754f02fd SHA-256: 165a92432543e7de584745f6f6c38ed5af8be6a1c639f1bde4dc7ae8b9c29647
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier as malicious. It contains a large number of external links, with one heuristic specifically identifying a 'mass external PDF link farm'. The embedded URLs, such as https://mezovuduw.ru/wix?keyword=clay+county+school+calendar+2020-21, suggest a phishing or SEO poisoning attempt to redirect users to malicious content. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=clay+county+school+calendar+2020-21 PDF link annotation
    • http://wudebakafepi.mypressonline.com/les_energie_renouvelable_en_algerie.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374021/normal_6062f5b09d02d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452395/normal_5ffe8c9b5bc6c.pdfIn PDF document text
    • http://filmera.ru/26504978610thdaz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382952/normal_5ffb7e9eae242.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372681/normal_6008fc48c5f58.pdfIn PDF document text
    • http://lnstgramhelpcopyright.com/negiruzonesl9wka.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368752/normal_605f3dc9d40be.pdfIn PDF document text
    • http://creditscoretrack.info/588892127833l0n0.pdfIn PDF document text
    • http://vizenam.medianewsonline.com/59336682869.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416806/normal_5fcbcea092f2a.pdfIn PDF document text
    • http://rowowesofazov.medianewsonline.com/must_have_to_should_ought_to_had_better_exercises.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489846/normal_6025526fdc874.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416149/normal_5ff0a87112051.pdfIn PDF document text
    • http://ruxuzosok.mywebcommunity.org/can_i_get_hbo_max_on_apple_tv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/89073927-2426-4b9c-b276-f3737f64b10d/ferekabadive.pdfIn PDF document text
    • https://8d5bcf17-53f2-4f21-b585-7a27aef14131.filesusr.com/ugd/7baf93_c00f2c3f7fb541429b8566ac9e4961a1.pdf?index=trueIn PDF document text
    • http://lolunoxij.myartsonline.com/similitude_and_approximation_theory.pdfIn PDF document text
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_f5857ce30d0647f092465a9d87339fd9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6ce6f98-cf8f-4133-becd-4ae7719281a8/43569829707.pdfIn PDF document text
    • https://b6f97e74-198a-461d-a312-d71b9712332b.filesusr.com/ugd/a2d007_6dc71e0123c647939129a567e28ba23b.pdf?index=trueIn PDF document text
    • https://0c7ecde5-8d52-4b6d-bf00-bcb9beb5fd3c.filesusr.com/ugd/b6f5a5_6b1d43694ee34cf0a09eb53cfc4729e5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6BA 5392 bytes
SHA-256: 64e63002841c074a40eeec1d555dcd3845ee0c858028a78833fbf3012ab45633
font_01_sfnt_off0000e912.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE912 10132 bytes
SHA-256: 73e9969cb48a94b9a7e21de8dfb024331f7e552d1bcf180647e5e00fad914f35

Open this report in the interactive analyzer, or submit your own file for analysis.