Malicious PDF — malware analysis report

Static analysis result for SHA-256 29c6e08e4bf705a8…

MALICIOUS

PDF

116.0 KB Created: 2021-03-14 13:23:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 06808a8a7d0fa7a0706b07969449a4a3 SHA-1: 728e98cf9cc5061c7520ad8642a018a30460f1f9 SHA-256: 29c6e08e4bf705a852d5fa0db86846d9d2842b9c3361b46ccf6235e11abf3384
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, with the primary malicious URL being https://jumiwimov.ru/wix. This suggests the document is designed to redirect users to potentially malicious sites. ClamAV detection and ML classification confirm its malicious nature, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=ancient+egyptian+civilization+is+divided+into
    • https://rogewakaz.weebly.com/uploads/1/3/2/8/132815912/poritogeturati.pdf
    • https://refiraledekire.weebly.com/uploads/1/3/4/7/134715744/7653075.pdf
    • https://static.s123-cdn-static.com/uploads/4417408/normal_5fe18def22e9a.pdf
    • https://pananufizusa.weebly.com/uploads/1/3/4/4/134445813/mudoduderanew.pdf
    • https://cdn-cms.f-static.net/uploads/4403422/normal_60487f831c432.pdf
    • https://jofusowosa.weebly.com/uploads/1/3/4/7/134764533/suwuxiwof_wezesopadi.pdf
    • https://static.s123-cdn-static.com/uploads/4424405/normal_5ff189ea09417.pdf
    • https://cdn-cms.f-static.net/uploads/4393016/normal_6018db3ea423c.pdf
    • https://gepavemu.weebly.com/uploads/1/3/4/8/134861499/4735500.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_1adee2c6640a4a15b9bcf8f0466ff856.pdf?index=true
    • http://bexudogi.rf.gd/gobstones_answers_penny.pdf
    • https://d86ad34a-7df2-4f47-937b-a12ab5abc0fa.filesusr.com/ugd/8cbfce_6c2a9e87a0c347649569cf4cd18d9a0e.pdf?index=true
    • https://e6f9d1db-9bad-45ba-a188-0e8e378e8087.filesusr.com/ugd/99b222_d1bb9c186cb64b0e841e42d2c19c2a2c.pdf?index=true
    • http://xazewuxeni.rf.gd/82682387136.pdf
    • https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_0929bd803b18461b9b54c8b1b947cd70.pdf?index=true
    • https://d71fc03c-aea6-48f7-a990-8afffb22108d.filesusr.com/ugd/3de8a6_7b702f52c1a1439b9c5b197b2a7d27a1.pdf?index=true
    • http://mibofive.epizy.com/fijevetila.pdf
    • https://1cd0d4d5-11d4-440c-a307-81f73801f601.filesusr.com/ugd/f0e51d_db6e8c0731b04e389c6c8a02c5db8a2e.pdf?index=true
    • https://s3.amazonaws.com/benuka/intentionally_defective_grantor_trust_tax_reporting.pdf
    • https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_803d48ddd4444f9d8b992c4dadea555a.pdf?index=true
    • https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_967e06afecb44c329504907ea789a821.pdf?index=true
    • https://s3.amazonaws.com/vefagotoje/xarasiginuw.pdf
    • https://s3.amazonaws.com/nevowimo/betazodixidivajotutukewa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018882.bin
51de9960389e2070e22cb5659e5ce040549317a4a1e9d345607a2e6a35b5502c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18882 5348 bytes
font_01_sfnt_off00019ae3.bin
acad9d513367050a69612ac573e788f59b7676ee937e249e8fec8f551023f720		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19AE3 11712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.