Malicious PDF — malware analysis report

Static analysis result for SHA-256 20135b8656f010dc…

MALICIOUS

PDF

84.5 KB Created: 2021-03-17 06:36:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c14d1735b9e47492084c617b21d09555 SHA-1: 685e0f516ad9604ad8e57862710493432a688e72 SHA-256: 20135b8656f010dc0b082375241dc63d64ece44455bb371c05d3f3e7b952096c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, pointing to various PDF files. One of these links, 'https://seumenha.ru/123?utm_term=eicher+380+video', is embedded in the document body and is likely intended to lead the user to a malicious site for phishing or malware delivery. ClamAV detection and ML classification further support its malicious nature, indicating a phishing or trojan payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=eicher+380+video
    • http://zemegulobeka.iblogger.org/duti_pata_bengali_movie_free.pdf
    • https://ledijonag.weebly.com/uploads/1/3/4/6/134689342/robometoliri.pdf
    • https://xubivotalo.weebly.com/uploads/1/3/0/7/130775972/8935885.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mikibetiv/lesubixixawanubi.pdf
    • https://s3.amazonaws.com/gitipelut/countries_formed_out_of_yugoslavia.pdf
    • https://s3.amazonaws.com/sedimeraxufi/68491961406.pdf
    • https://s3.amazonaws.com/besafefaf/xawefa.pdf
    • https://d9c73feb-c945-4d97-9d44-ff62a4b57c47.filesusr.com/ugd/12056e_9c13548e5cca4829bc433cb40d9fa752.pdf?index=true
    • https://510b81f6-be4e-4e40-9acf-3f60af495837.filesusr.com/ugd/5f226b_c85dfe96a6994a8fa1458929c1185dfb.pdf?index=true
    • https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_47d5517e579a4286b70eb5fc24783f28.pdf?index=true
    • https://d1ee23ee-9ccf-45b0-80ef-1e1ff1f657c4.filesusr.com/ugd/9ef0c3_6d44429c0c454fd5b2533eec2d6539de.pdf?index=true
    • https://s3.amazonaws.com/timeziso/nevupekoforalipozi.pdf
    • https://f3874c2d-c116-49c2-b7b6-9300dc8fc43e.filesusr.com/ugd/b11f6d_cdafef9f92a64605abf94c67679565d2.pdf?index=true
    • https://s3.amazonaws.com/fovezewi/canvas_draw_background_image_android.pdf
    • https://s3.amazonaws.com/nawosineromigi/aambala_movie_song_ringtone.pdf
    • https://s3.amazonaws.com/tufitijinexu/types_of_enhanced_interrogation_techniques.pdf
    • http://sivabesu.epizy.com/volunteer_sign_up_sheet_template_google_docs.pdf
    • https://s3.amazonaws.com/jipowumat/vitamix_3600_container.pdf
    • https://s3.amazonaws.com/datarofapakil/how_long_should_i_cook_chili_in_a_slow_cooker.pdf
    • https://s3.amazonaws.com/nedijowewoded/pathophysiology_of_acne_vulgaris.pdf
    • https://s3.amazonaws.com/negonanopix/29910291482.pdf
    • https://s3.amazonaws.com/vetamedisoz/pumamifejuduloji.pdf
    • https://s3.amazonaws.com/wonumafubij/lizzo_flute_sheet_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7cd.bin
9db6dbfb1c309863725a33219b6da846a95191f8e3025094c106e3498b738f41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7CD 5124 bytes
font_01_sfnt_off0001094a.bin
8cd5de766e7f0f2d2ed5609b564542eddd88caf88e27b595edbd4bca33710c5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1094A 10596 bytes
font_02_sfnt_off00012d97.bin
4bd16c8abd39118228c1571b0005d4eb3b3e943e572fd92a2a80cfcb7b749349		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D97 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.