Malicious PDF — malware analysis report

Static analysis result for SHA-256 169c65f4767408b3…

MALICIOUS

PDF

75.4 KB Created: 2021-04-02 11:49:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dbfcb608980e9bd99c5b9d9b07e1481b SHA-1: b4e6912155149a995c0dda07667bd65c6825519b SHA-256: 169c65f4767408b36682d896c6fed27dfa04bb43c31bef5a59e3d0b5033292d7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan-like behavior. It contains a large number of external links, suggesting a link farm or redirection mechanism to malicious sites. The primary suspicious URL identified is https://mezovuduw.ru/wix?keyword=pronouns+and+their+antecedents+worksheet+pdf, which is likely used to deliver a secondary payload or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=pronouns+and+their+antecedents+worksheet+pdf
    • https://cdn.sqhk.co/vedimurami/Jskjghb/secret_codes_for_blood_moon_tycoon.pdf
    • http://pojopazutapo.iblogger.org/quantica_capital.pdf
    • http://itdomen.fun/39221004792w1fb5.pdf
    • https://cdn.sqhk.co/juzurupivepo/fh4RPLH/find_five_below_store_near_me.pdf
    • http://wegansit.space/91864427664kuaz5.pdf
    • http://nijowefipegivu.iblogger.org/sebav.pdf
    • http://akfb.online/game_companion_nfs_heat_xbox_one14itc.pdf
    • http://cz-nitrof.website/bulova_mens_marine_star_diamond_accented_black_dial_watch_98e003809s5.pdf
    • http://afracheat9.xyz/zurodatavipijowefa7lz4e.pdf
    • https://cdn.sqhk.co/bajowekununa/jdGVyLG/tunulegobigobepaxivaxix.pdf
    • https://cdn.sqhk.co/lixipadiwel/Oicih9P/hide_file_android_studio.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b6e49935-6d58-4bde-831f-6e0b746776d3.filesusr.com/ugd/7d321f_4c4d744fca23463787eced47d8523827.pdf?index=true
    • https://5e3b32e6-a537-4a58-a531-ef303a468713.filesusr.com/ugd/120874_5547bac6c5074988a377bf06b2af6b34.pdf?index=true
    • https://e108c0fa-8e70-4110-aab7-e0d30777705f.filesusr.com/ugd/d9966b_dc597a23be9c491da90db6f923cfbe9e.pdf?index=true
    • https://8aefc570-8454-48c3-bb63-d4d1067b7ce0.filesusr.com/ugd/5c9621_5c9f91eebbac42ca97d7de070b93bed5.pdf?index=true
    • https://f4b9ed98-44c1-44e6-9966-d9817cd43de7.filesusr.com/ugd/9ced5d_1463292f87da4179841b79a418920ba9.pdf?index=true
    • https://f74ea38a-ab8d-49a0-8d31-9a1d7ce64423.filesusr.com/ugd/5ceade_5c6497a8a18b471d947da1e476e50acc.pdf?index=true
    • https://46fb9a51-9e16-4ad8-811e-2f7ed01702f7.filesusr.com/ugd/53363c_680cd2af8c9641a3970144713a6a8e19.pdf?index=true
    • https://20128683-61eb-4207-b985-d468b1a81fea.filesusr.com/ugd/0049ca_b7c0033c3ab349c4b0bb33d7ea30b342.pdf?index=true
    • http://bakisuv.rf.gd/39431786995.pdf
    • https://fb413987-6e77-4bf1-aaa6-e97eb550fbee.filesusr.com/ugd/108936_a7b4acd59e8c48d8a3c85b26620d32f8.pdf?index=true
    • http://tidovikuvam.epizy.com/9.pdf
    • https://29ce6865-365c-47c4-9f0a-635d6f965865.filesusr.com/ugd/0d6b77_536aaa43e564448e83fd390a5b370fc8.pdf?index=true
    • http://rojikigekon.epizy.com/letozudivapabevigivinuv.pdf
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_3bcfd2c3eb3c47d7bcd7f19394b33539.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3d6.bin
69b62848257662bcc184a8c81e80d8af470aea6bf902923ae0b0f64a510c6d42		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D6 5368 bytes
font_01_sfnt_off0000f627.bin
3da650bcc4c3d6707c60e70aaa663f5853a5eca756d3a4cf47d0bd5bc6cb07e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF627 12740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.