Malicious PDF — malware analysis report

Static analysis result for SHA-256 18689f927a7883f5…

MALICIOUS

PDF

69.6 KB Created: 2021-03-17 08:53:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f91e12780e0821d7cede904a114c789f SHA-1: 7291fb4ab59326f71c2bbb956bb3d1c79202fb22 SHA-256: 18689f927a7883f5e871a9ddacd3d1f4126a8a1c8f8638dd4511333693be728c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous embedded links, with a significant number pointing to external websites, suggesting a link farm or phishing lure. The primary URL identified, https://leonvi.ru/award?keyword=information+about+all+planets+pdf, is likely part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=information+about+all+planets+pdf
    • https://xotozefubineru.weebly.com/uploads/1/3/4/5/134576546/zegofe.pdf
    • https://bogekivusuwi.weebly.com/uploads/1/3/4/6/134604255/muzisalarutoro-nosagaxelelaku.pdf
    • https://cdn.sqhk.co/kagumuzom/l0GjfJC/buzononuweperaburorepopis.pdf
    • http://filitopalanima.22web.org/wofunepilibujelodorid.pdf
    • https://cdn.sqhk.co/sovokeduseb/pDNhiif/xoguxoginisuzu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sivakekixil.epizy.com/grainger_catalogue_free.pdf
    • https://uploads.strikinglycdn.com/files/ce8268e9-4d81-4db9-bfc5-1a1ad0dddd60/how_to_write_a_research_paper_in_a_short_amount_of_time.pdf
    • https://uploads.strikinglycdn.com/files/030acc64-7d36-4373-8fb5-9e92c4d4bf9f/safeline_metal_detector_calibration.pdf
    • https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_059b9573d9e04ae98621089111691bf4.pdf?index=true
    • https://6a421494-2577-4416-904f-e17348f56b63.filesusr.com/ugd/85e76a_71f2c812fbb847c3a22fc22697c5df92.pdf?index=true
    • https://dd907c4b-492b-4b4d-bf3c-9f0b7a2bd2c7.filesusr.com/ugd/96a426_ebeca4b91b0f4f09bddc0dd2795f635a.pdf?index=true
    • https://ce55c564-0e79-48ac-bd91-a034cff8554b.filesusr.com/ugd/bd1fc0_796a614fb59b486a882045f89b237108.pdf?index=true
    • https://9387bd13-3746-4408-b474-2867f26e464d.filesusr.com/ugd/ace02d_955d41e4cb9145cc962d2601a654eb2f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8b6b0920-fd70-434d-9587-81521a4b92bd/video_games_to_play_with_friends_on_different_computers.pdf
    • https://uploads.strikinglycdn.com/files/d78f6f7d-bb4a-4b73-bf9f-2b4adeaa9033/down_the_rabbit_hole_game_hints.pdf
    • http://renodiwug.epizy.com/pemujow.pdf
    • https://62619d47-812b-4c4f-a232-aa08d86264e8.filesusr.com/ugd/6d62c1_500efe34692d4d3b9547f8325aa4b9a7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2c08a766-7924-46ea-8111-45a4681d8118/where_to_see_cactus_in_sedona.pdf
    • https://5a060084-92f5-4e09-b02e-bbac8bb45871.filesusr.com/ugd/05c943_f8d33cc739f24bbda08229cc03eac38a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2cf.bin
1db80b83972357c6e581491ff071b8c743f3f44680df581983e06eb1da5c00ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2CF 5264 bytes
font_01_sfnt_off0000e490.bin
19e82b483562363bdad3567b63cfb0d995e796fbc811f5a34a6c743f4ddfc09b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE490 10688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.