Malicious PDF — malware analysis report

Static analysis result for SHA-256 27835d0fb8a41c8c…

MALICIOUS

PDF

95.4 KB Created: 2021-03-07 19:20:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 03be130500db22b126ffb74d8aba8890 SHA-1: 7c1be5bb3f4bea3d6483a324c3745b4eb26f6125 SHA-256: 27835d0fb8a41c8c361d9e71f5fbc6a451749ba0a1871540dac827d13031c824
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm designed for SEO manipulation. One prominent URL, https://mezovuduw.ru/wix?keyword=ssl+duality+se+manual, is flagged as suspicious. ClamAV detection and ML classification strongly indicate malicious intent, likely phishing or malware delivery via the linked content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=ssl+duality+se+manual
    • https://static.s123-cdn-static.com/uploads/4427509/normal_5fec1f561baf3.pdf
    • https://cdn.sqhk.co/dogutadova/ifire5x/59512552743.pdf
    • https://cdn.sqhk.co/mofokamibe/cS6fSVh/basket_wall_decor_set.pdf
    • https://cdn.sqhk.co/sadirurafixi/whjj8Tb/dead_alone_lyrics.pdf
    • https://cdn.sqhk.co/gesimefav/hh0aJJP/nevafujajowuriz.pdf
    • https://static.s123-cdn-static.com/uploads/4365606/normal_5ffbd408710d9.pdf
    • https://cdn.sqhk.co/kukisigafumi/ADhgjgr/98015635976.pdf
    • https://cdn.sqhk.co/devisofage/imDgdid/download_game_samurai_flash_mod_apk.pdf
    • https://cdn.sqhk.co/xenumobavun/BEgdicT/56354102040.pdf
    • https://static.s123-cdn-static.com/uploads/4481831/normal_5ffbf31dc2a53.pdf
    • https://cdn.sqhk.co/jogepirar/ashhFzU/winixuxebelazewitorosu.pdf
    • https://cdn.sqhk.co/lufelumad/hjhfFMl/turoram.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://scripts.sil.orgThis
    • https://s3.amazonaws.com/miledu/play_the_song_behind_closed_doors_by_charlie_rich.pdf
    • https://s3.amazonaws.com/fajetufekejo/figemeturidarunob.pdf
    • https://6c473ef0-402e-45f0-9f95-6bc7e89a6a1a.filesusr.com/ugd/5518c3_f1c2543fd6d54cbaad18733e36d3f0b0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b4fe62c9-d7d6-4b68-998a-4c25b04a90d2/what_is_bios_key_for_hp_laptops.pdf
    • https://s3.amazonaws.com/sonutopexaramuf/dinosaur_skeleton_printable_pasta.pdf
    • https://uploads.strikinglycdn.com/files/cf48e021-1c5b-4f2e-ba00-a5ec447a87dd/wafoligugumex.pdf
    • https://937a8a2d-b41a-4163-aff8-eda6db263557.filesusr.com/ugd/21e6f2_e44a0d587ca04b0280702d80d9cb0b1a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/18c862dc-7b3d-4122-ae14-54f7fbcddeaf/71162112121.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://scripts.sil.org/
    • http://scripts.sil.org/OFLAbyssinica
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001025f.bin
070b6d765869bf6344e47dd561e676dd434a500cf47df64f8e487783698f6120		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1025F 5080 bytes
font_01_sfnt_off0001139a.bin
7c8c6441be768cd37d23ca7cd548906e6c28b3c6b5e62ebba7a27cb17d8b815c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1139A 21012 bytes
font_02_sfnt_off000133f3.bin
cce6e8d7cac3d60cfc205718bf2fef249167a7f671e6be3add7f88dc20136365		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133F3 11004 bytes
font_03_sfnt_off00015959.bin
b1615e29a4fe6c7320d553a30418b4fece26933a192be804fa4a6c1955e67a67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15959 16068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.