Malicious PDF — malware analysis report

Static analysis result for SHA-256 2453e39704c28b70…

MALICIOUS

PDF

78.6 KB Created: 2021-03-20 01:01:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68271fe5a8a0207288618b83d4bdf2fa SHA-1: 4b03f4002050d0c7afc38197186e699294ea4f7e SHA-256: 2453e39704c28b70fb78213dcb29a00a74bc4603fa7c82a94bb3b5bf80acf840
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with one pointing to a suspicious domain (jumiwimov.ru) and another to a potentially generated SEO link farm. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a phishing or malicious content delivery attempt. While no scripts were directly extracted, the PDF structure and embedded links suggest an attempt to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=android+map+network+share
    • https://static.s123-cdn-static.com/uploads/4459785/normal_5ffd68f6f252d.pdf
    • http://it50off.pro/sejuwodajisixixyzjz.pdf
    • https://static.s123-cdn-static.com/uploads/4495271/normal_60039c3752f1e.pdf
    • http://becloud.website/toxiruponutefokovgg6mq.pdf
    • http://plusstore.pro/what_can_a_2000_watt_inverter_generator_runsl0xb.pdf
    • https://static.s123-cdn-static.com/uploads/4530151/normal_5ff463a3f299d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/02c1586d-5249-4df3-ae1a-b81d5d07ace5/how_long_does_brown_rice_cook_in_a_rice_cooker.pdf
    • https://s3.amazonaws.com/sesijesule/pak_study_notes_for_ba_in_urdu.pdf
    • http://kurujabarufuxe.rf.gd/81890091388.pdf
    • https://36c399da-a80c-44c8-bdf8-ee1d737978f0.filesusr.com/ugd/738632_eb57d99bb01845a4aa61e3acdab24ff2.pdf?index=true
    • https://s3.amazonaws.com/kiwopusafize/18218070035.pdf
    • https://de7eff9d-5c50-4122-bb99-ee112abf7a8f.filesusr.com/ugd/db8f21_cd6eb88c0a404eefb8c3773c019f1fe8.pdf?index=true
    • http://vomifavub.epizy.com/48392600387.pdf
    • https://s3.amazonaws.com/wewuxuviwar/carrying_the_banner_piano.pdf
    • https://s3.amazonaws.com/tuzakifezara/beautiful_baby_photos_free.pdf
    • https://6478d21b-237c-41b5-add8-96d7b9819624.filesusr.com/ugd/c7ef1a_2e286893fd794e9f9a8a5e52147aaf51.pdf?index=true
    • https://s3.amazonaws.com/bovenotojitowe/gisapawinezigawogin.pdf
    • https://uploads.strikinglycdn.com/files/50795ee0-abbd-430a-a306-c5caf8f3e96e/toguvososexovadojovewoja.pdf
    • https://1c985592-4fe2-425a-b8d2-7dc24782370c.filesusr.com/ugd/a13bc2_3eed146e43514a6f8e7ee01693cd6f31.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f64e.bin
8236f34311ba5095a80c74ca20362a50e9e3308d5180e769151fe2a7e6cb3f7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF64E 5312 bytes
font_01_sfnt_off0001083e.bin
ef6b6f389e204e795bc11797436a63582c552e70f7b9274f9e0cb065bbd086e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1083E 10872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.