Malicious PDF — malware analysis report

Static analysis result for SHA-256 24b740255379685c…

MALICIOUS

PDF

77.0 KB Created: 2021-04-05 08:00:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d4d4fb4a3c57c0eabe58742f9ee5004b SHA-1: e51e9904b74240792a59803bd986d05a745a9747 SHA-256: 24b740255379685cad87acc4d5ed1daa3e63fa5e407093b06330b22a7fa3abe1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents. One of the primary URLs extracted is vilenefex.ru, which is likely part of a link farm or redirection scheme. ClamAV also detected this file as Pdf.Phishing.Trojan, indicating malicious intent. The ML classifier further supports the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=the+baby%2527+s+room+2006+movie
    • http://sajiwurejedetu.sportsontheweb.net/ley_de_cambio_climatico_mexico.pdf
    • https://static.s123-cdn-static.com/uploads/4378608/normal_6002ee2115a73.pdf
    • https://cdn-cms.f-static.net/uploads/4450256/normal_6047e4cc8d340.pdf
    • http://kozugufasuroti.mygamesonline.org/cash_flow_statement_direct_method_problems_solutions.pdf
    • http://zovolexune.sportsontheweb.net/rulebazigipinagilemudi.pdf
    • https://cdn-cms.f-static.net/uploads/4461791/normal_6041ead6ee7e2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7c584399-f78a-448b-b986-1a40def719d0/zerejim.pdf
    • https://s3.amazonaws.com/jazuravazaguz/14091507863.pdf
    • https://uploads.strikinglycdn.com/files/3c864088-2fc3-47f8-a1b0-8ac260a7b5e9/what_do_you_understand_by_sustainable_economic_development_class_10.pdf
    • https://1801fa0f-56e4-4894-8452-b8e06651d4be.filesusr.com/ugd/868401_6a6a483a1fe142cea8a23497a1ea5c44.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3bd96104-e0bd-4b59-8854-082f5009351c/lezeledusawujukerafiz.pdf
    • https://uploads.strikinglycdn.com/files/9deca662-94b5-40a0-8e9e-58ff717a67af/toque_de_bandera_para_nios_de_primaria.pdf
    • https://uploads.strikinglycdn.com/files/da5fbe5e-567c-4414-963c-f5018b00cfe2/hot_springs_sovereign_spa_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/9f7e4c22-4b78-494c-897a-63e74be4fe11/what_does_title_mean_on_1096_form.pdf
    • https://s3.amazonaws.com/wamatasamegu/c._i._d_episode_3gp.pdf
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_1a14124f1cbe4afa824e4f24aefb7b0a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/30c05b3f-635d-4007-98bd-08c6ff09a8c6/best_selling_poetry_books_of_2020.pdf
    • https://uploads.strikinglycdn.com/files/2b842282-fe2a-4e5f-97d1-5f783e11f11d/how_long_to_prepare_for_step_3.pdf
    • https://uploads.strikinglycdn.com/files/98482e01-fbdc-40fa-99b2-23c9758daaee/32159821326.pdf
    • https://uploads.strikinglycdn.com/files/04ac63fd-f287-428e-aed5-27520ef0ae5b/dobakirafazidiva.pdf
    • https://s3.amazonaws.com/divexikav/matoxazenogiwovu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eebe.bin
ab46b73303eceae15e902a375ff7d0d89fa9f37dbb5ecbd85c924ba83542dcdf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEBE 5608 bytes
font_01_sfnt_off000101b3.bin
87e310c6ee13a68c60ec25f8a259072f3f718770c087f01d9d6009e59f4f3a3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101B3 10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.