Malicious PDF — malware analysis report

Static analysis result for SHA-256 2208b15e4e2b819e…

MALICIOUS

PDF

76.3 KB Created: 2021-04-26 10:42:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c7c00af6f58acf4766186f1eba6a0289 SHA-1: 9b70e971ef7a6186ba7254da708f1b17f97e8730 SHA-256: 2208b15e4e2b819ef04fef19d6744f65ec5db5175584066e9c81ce765936256d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to manipulate search engine results or redirect users to malicious content. The presence of an external URI pointing to 'midufefew.ru' further supports this malicious intent. ClamAV detection as 'Pdf.Phishing.Trojan' and the ML classifier's high confidence score indicate a malicious nature, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=them+belly+full+tab PDF link annotation
    • https://wawodupalise.weebly.com/uploads/1/3/4/6/134621762/b091968.pdfIn PDF document text
    • https://dapekedes.weebly.com/uploads/1/3/4/6/134643928/844482765abd.pdfIn PDF document text
    • https://lafajadisevo.weebly.com/uploads/1/3/1/4/131454770/1777d87f0bb.pdfIn PDF document text
    • http://zonagareme.getenjoyment.net/icai_accounting_standards_notes.pdfIn PDF document text
    • http://siteznakomstv69.space/effects_of_globalization_in_educationbrt08.pdfIn PDF document text
    • http://unreguezff.rest/adobe_flash_player_9._0_free_downloadw4d3j.pdfIn PDF document text
    • https://xuredetinumimo.weebly.com/uploads/1/3/4/6/134630251/xulisulurimid.pdfIn PDF document text
    • https://jefanumu.weebly.com/uploads/1/3/4/8/134889008/kipuloron.pdfIn PDF document text
    • https://sorudexene.weebly.com/uploads/1/3/1/3/131384015/jukimuperiwakigefova.pdfIn PDF document text
    • https://kejidelevotina.weebly.com/uploads/1/3/5/3/135326148/nezonesa.pdfIn PDF document text
    • http://makamar.xyz/control_systems_engineering_nise_7th_editionlu1mv.pdfIn PDF document text
    • https://xukusoresi.weebly.com/uploads/1/3/4/4/134488105/3432b7447b46bcd.pdfIn PDF document text
    • http://dokumenty-kiev.online/why_is_my_generator_engine_surgingr6bid.pdfIn PDF document text
    • http://carishr.com/545098603430vbml.pdfIn PDF document text
    • https://rasajelisulozin.weebly.com/uploads/1/3/1/6/131637016/majaxigabatowefuvox.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rizezobabub/nice_guidelines_delirium_screening.pdfIn PDF document text
    • http://fojosotum.myartsonline.com/dozuginikuxijorojera.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/luzitulovepajenavid.pdfIn PDF document text
    • http://saxodanokijaj.atwebpages.com/how_to_do_crochet_box_braids_on_short_hair.pdfIn PDF document text
    • https://s3.amazonaws.com/banula/danby_dehumidifier_with_pump.pdfIn PDF document text
    • https://s3.amazonaws.com/pokorevalaxex/luvapunixedawewefij.pdfIn PDF document text
    • https://s3.amazonaws.com/rupatojuko/star_trek_discovery_season_3_episode_6_imdb.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/how_much_does_a_2019_shelby_gt500_cost.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/gezuvenupelumuz.pdfIn PDF document text
    • https://s3.amazonaws.com/minaxigevani/draculas_guest_by_bram_stoker_summary.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECDD 4924 bytes
SHA-256: cf694249e5e0580f6ebc62764789a6d6cdd690974b6ba5bb8db33f7235da9239
font_01_sfnt_off0000fd89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD89 11212 bytes
SHA-256: 1076ec490ac0d5b50d07c5678d19e24f1ba013096a4d7647dc4e857822d4ea9e

Open this report in the interactive analyzer, or submit your own file for analysis.