Malicious PDF — malware analysis report

Static analysis result for SHA-256 252e2cf7b1b96386…

MALICIOUS

PDF

91.5 KB Created: 2021-05-24 16:44:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4acfc4b4f24741bb079d7ddfdb8c8361 SHA-1: c941b76f77f817423c0cac56389cb7e390e37f0c SHA-256: 252e2cf7b1b96386a60d170a57c54bf4316ae952ed9540809fc92b8c9ec6c291
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the presence of external URLs and the nature of the heuristics point towards a phishing or malicious redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=what+is+the+primary+goal+of+propaganda+art
    • https://jojipizi.weebly.com/uploads/1/3/1/6/131606457/govusobaf.pdf
    • https://webebusili.weebly.com/uploads/1/3/0/9/130969565/6415590.pdf
    • https://bopiwode.weebly.com/uploads/1/3/4/3/134367631/savoj_zazobuxenog_soparokedo.pdf
    • https://kekulewu.weebly.com/uploads/1/3/4/3/134398637/81f708d.pdf
    • https://nibapexi.weebly.com/uploads/1/3/0/9/130969889/mekazelirobal-vavifakatenuz-zozelisudetejub.pdf
    • https://pabidiwamudobav.weebly.com/uploads/1/3/5/2/135299897/xuxakarogivugupizova.pdf
    • https://xutafutixon.weebly.com/uploads/1/3/4/5/134576274/jubixaxuwido.pdf
    • https://xepezexitig.weebly.com/uploads/1/3/0/9/130969834/d894da07f.pdf
    • https://pezofonarumupub.weebly.com/uploads/1/3/5/3/135396673/b2bd6fef2ba74.pdf
    • https://varusotefus.weebly.com/uploads/1/3/1/3/131398431/nisafadutilipe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/fda4ea57-d252-4caa-aff0-fbac98175ab1/harry_potter_complete_8_film_collection_blu_ray_limited_edition.pdf
    • https://uploads.strikinglycdn.com/files/d640c175-c765-435d-a80d-70120931300c/schwinn_airdyne_parts_canada.pdf
    • https://uploads.strikinglycdn.com/files/3fa3d7e5-86c9-4aeb-a71a-ea43c0fc8719/6490299297.pdf
    • https://s3.amazonaws.com/lezerawe/poxiluwidanaba.pdf
    • https://uploads.strikinglycdn.com/files/9323778c-31d8-46ad-b31f-97ee0ca82f53/elvis_what_happened.pdf
    • https://uploads.strikinglycdn.com/files/133f4c38-b067-4a4d-8ff0-7900c2b0ee13/free_robux_generator_2020_no_human_verification_real.pdf
    • https://uploads.strikinglycdn.com/files/d74ea0dd-d53f-4770-a573-e1ba47214092/koxuzakuvubusama.pdf
    • https://s3.amazonaws.com/savukojubusum/sivitewiko.pdf
    • https://uploads.strikinglycdn.com/files/5a0231f8-59a2-4e8d-af9c-d37c2e6177ff/12758813039.pdf
    • https://uploads.strikinglycdn.com/files/6efa3f94-d75f-41e8-9531-153b582fcb9f/34728184218.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010436.bin
5ce2fea85de0176fa3e22e2fa4d179f5c52490d53be97bd46c6f0b2ac5469026		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10436 5356 bytes
font_01_sfnt_off0001165b.bin
a117a70748cd4e9ae493267294461dc04667f2fe5fd0f7e805587e81f81a8b2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1165B 11080 bytes
font_02_sfnt_off00013c4e.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13C4E 16204 bytes
font_03_sfnt_off0001517c.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1517C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.