Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e87746cf50ed524…

MALICIOUS

PDF

81.7 KB Created: 2021-04-04 22:57:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e374e8e1b1ddef25d7fd4ba9987ad572 SHA-1: 928ca1d8e98411d75c7f9db666ac045f3be8df58 SHA-256: 1e87746cf50ed5241ad07fe65c946e4c4d34d24fd2e757d7ca8ca32df31141c3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are generated for SEO purposes, indicating a link farm or phishing attempt. The primary URL, https://mezovuduw.ru/award?keyword=aushadh+darshan+pdf+in+gujarati, suggests a lure to download potentially malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=aushadh+darshan+pdf+in+gujarati
    • https://cdn.sqhk.co/xevowuto/Jge1bjg/41789050641.pdf
    • https://cdn.sqhk.co/zafowavo/bKLIjeR/my_burger_shop_online.pdf
    • https://cdn.sqhk.co/modonasuje/bfribtV/86218552889.pdf
    • http://worigozuwujuva.iblogger.org/10463237761.pdf
    • https://kesuvovim.weebly.com/uploads/1/3/5/3/135317554/fd4d332798ec.pdf
    • https://fulotetaputu.weebly.com/uploads/1/3/2/7/132740707/kekixatujanofowiwu.pdf
    • http://ruzagasaz.iblogger.org/abstract_reasoning_test_4_answers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://neluwomarar.epizy.com/guloxa.pdf
    • https://s3.amazonaws.com/fipijife/rilosutosuxaden.pdf
    • https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_8f266f74b5f948e79898e84373483c84.pdf?index=true
    • https://48e5b1ff-25fb-49a4-826b-3ad3f3a15688.filesusr.com/ugd/0d632a_04196cab152249c0b3dbadffae2db22d.pdf?index=true
    • https://ab737b70-891a-4a1f-8db9-ee548211cb31.filesusr.com/ugd/ce14f3_0e934a67d185405d8ec0461ce13738d4.pdf?index=true
    • https://s3.amazonaws.com/wiremeresegikon/70663147076.pdf
    • https://7f1158f2-e44e-4cac-991a-806210d1dc3e.filesusr.com/ugd/e4a8e1_c1096c6c6c35480c9ef7cf684c22a29c.pdf?index=true
    • https://s3.amazonaws.com/pululusodogi/witcher_3_walkthrough_wandering_in_the_dark.pdf
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_3f7ed6fd84d44c65a9eafddf2244f463.pdf?index=true
    • https://e49cd12a-7e53-4a25-9f98-ae37b5ff2e44.filesusr.com/ugd/35dc59_f60abe03d437440a806e550ba965abf2.pdf?index=true
    • https://s3.amazonaws.com/duzexefemosaxe/16998093433.pdf
    • https://2a085669-a8dc-40eb-b1d3-71ea9d660f60.filesusr.com/ugd/cafc24_7bc26f92f04b40f7b8cc7890a6875fd6.pdf?index=true
    • https://s3.amazonaws.com/gulapore/grange_hill_theme_sheet_music.pdf
    • http://lexulegoserixa.epizy.com/gojekulugedelapin.pdf
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_ef8908d3f0d447dcb349fb2e0bb859c9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f21e.bin
9fceec68257c57dfb8b9088bf4040c6f1878c735816192adae55bfd5ed297f23		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF21E 5336 bytes
font_01_sfnt_off00010446.bin
c0b855f93115bcd8352bdc66be86d8b722de4dcc8f91206662ab066421c5b6b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10446 11200 bytes
font_02_sfnt_off00012a87.bin
dbaa8fca7998f4f88812f3d0e1f7c7123bd970d78d37ae63ea3f3a1f03da8d10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A87 3676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.