Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b315752fc8cb092…

MALICIOUS

PDF

77.7 KB Created: 2021-03-24 04:09:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 522fee9313c45d6239a1382cd9482e35 SHA-1: 4934ebb9b681b246edf4bace8956bf6c9f476edd SHA-256: 1b315752fc8cb0922bf545bc087f2910cdfdb2777ecfbceccb5f71bbf93a25da
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a large number of external links, suggesting a link farm or SEO manipulation tactic. The primary URL, https://seumenha.ru/award?keyword=multivariate+statistical+analysis+kachigan+pdf, appears to be the intended lure, while the other URLs likely serve to bolster the SEO or distribute further content. No scripts were extracted, but the PDF structure and link farm indicate a phishing or malicious content delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=multivariate+statistical+analysis+kachigan+pdf
    • https://puramekekekiz.weebly.com/uploads/1/3/4/6/134648744/remonoxejivuxawexu.pdf
    • http://pazujiz.mygamesonline.org/kenmore_series_100_washer_not_spinning.pdf
    • http://rolapisi.scienceontheweb.net/esoteric_bible_interpretation.pdf
    • https://buvonumonub.weebly.com/uploads/1/3/5/3/135304713/redamaxexogili-zagen-wapute.pdf
    • http://zujugowez.iblogger.org/mixesiniru.pdf
    • https://bevazemirif.weebly.com/uploads/1/3/4/8/134873662/wurak.pdf
    • https://nidedijuba.weebly.com/uploads/1/3/0/8/130814831/8375090.pdf
    • https://zoforute.weebly.com/uploads/1/3/4/3/134352948/288ec25.pdf
    • https://femezusuf.weebly.com/uploads/1/3/1/6/131606597/7993612.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zegiwewezenaro.myartsonline.com/atrial_fibrillation_treatment_guidelines.pdf
    • https://dba0ca6b-c979-46b3-87c9-041648dee063.filesusr.com/ugd/6f58fb_7b5e2c41f1c24c4fa0f4115786451480.pdf?index=true
    • http://povovudajax.rf.gd/why_does_my_hopper_go_into_standby_mode.pdf
    • http://todidetiped.onlinewebshop.net/35486553843.pdf
    • https://adc67df4-9ac4-4169-8225-f8d60376216a.filesusr.com/ugd/a1c2c7_abb8fe7d468941f299d3c64362ae1582.pdf?index=true
    • https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_922ef7b728c848a5ab6324064e6dca4c.pdf?index=true
    • https://s3.amazonaws.com/vososasoxumete/rorusagidesewiwegili.pdf
    • http://vidavizulovox.rf.gd/tojaluwojiva.pdf
    • https://s3.amazonaws.com/bogijexu/nijafajivavuladevebesumu.pdf
    • http://nonogopikizezed.rf.gd/64242040960.pdf
    • https://fb3efafe-1b0e-41a1-9434-8bf556110c4a.filesusr.com/ugd/de5e41_6658b6a9d3e24125a68e233ffff8264c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f16e.bin
474bbe1f184529a0cc376323c64a1397a9f957468272e1ab051209be9ac0d138		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF16E 5648 bytes
font_01_sfnt_off000104be.bin
f16de638efa0b271346eefa049e4b5e4ded41cedf4c03f43feeb8384d482bfda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104BE 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.