Malicious PDF — malware analysis report

Static analysis result for SHA-256 2aba2547f032fa0e…

MALICIOUS

PDF

78.9 KB Created: 2021-03-19 00:14:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 167e298c8601bd963f137e5d0d7eb62c SHA-1: 52c7860b1f6c3764115c4a7421e8109758f21423 SHA-256: 2aba2547f032fa0ee871263668957d705bd58a3aed43a8d52746b7551f816447
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating it is likely a phishing or exploit document. It contains numerous embedded URLs, with one notable URL pointing to `https://vilenefex.ru/wix?keyword=open+ports+cmd+windows`, suggesting a lure related to system administration or security. The presence of 'cmd' and 'windows' in the URL, combined with the 'SE_LOLBIN_RUN_COMMAND' heuristic, indicates an attempt to trick the user into executing commands.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=open+ports+cmd+windows PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4425933/normal_5fdd090a48d64.pdfIn macro / runtime command snippet
    • https://nozirurabi.weebly.com/uploads/1/3/0/7/130738896/db0530882e8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480756/normal_60175eac1eaa5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4468554/normal_5ffdc8892ec55.pdfIn PDF document text
    • https://womutiliwefol.weebly.com/uploads/1/3/5/9/135964171/bepikajipixefukabaro.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420028/normal_6034a1a46be76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480412/normal_602948bfd924a.pdfIn PDF document text
    • http://xabusiwidurej.22web.org/86349317977.pdfIn PDF document text
    • http://varuvoruva.iblogger.org/19033670007.pdfIn PDF document text
    • https://xonarupitowij.weebly.com/uploads/1/3/4/6/134617661/17aa31e0f27c0.pdfIn PDF document text
    • http://nalajiboto.iblogger.org/honda_eu1000_air_filter.pdfIn PDF document text
    • http://zowomojagobipur.iblogger.org/czasy_gramatyczne_angielski_wiczenia_chomikuj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bezujadavi.rf.gd/ludzie_bezdomni.pdfIn PDF document text
    • https://efa91360-7c21-416c-9d60-3189e0beb381.filesusr.com/ugd/42ffc7_e2676f125ceb4f13abaafcff0a7e848b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wusone/5151791089.pdfIn PDF document text
    • http://lemunewelow.epizy.com/50394846652.pdfIn PDF document text
    • https://s3.amazonaws.com/pezofut/zutopajokudikas.pdfIn PDF document text
    • https://5ce19dfa-329f-495d-88d1-e1e7834d9072.filesusr.com/ugd/d902bb_98518efbd9f24c4899686aab567ccb06.pdf?index=trueIn PDF document text
    • http://junimufik.epizy.com/jinja2_ansible_tutorial.pdfIn PDF document text
    • http://vedewigawis.epizy.com/25649634916.pdfIn PDF document text
    • https://s3.amazonaws.com/vapelurowar/44745141696.pdfIn PDF document text
    • http://jejijumebiv.epizy.com/90855584079.pdfIn PDF document text
    • https://s3.amazonaws.com/wupiwupiwot/39256767475.pdfIn PDF document text
    • https://711a90e7-97f2-4eab-8690-3003ec1e9b64.filesusr.com/ugd/a0905b_3cae2f67126541148066753b5a1b27ab.pdf?index=trueIn PDF document text
    • http://befadiw.rf.gd/53802963781.pdfIn PDF document text
    • https://s3.amazonaws.com/bejenosugede/mokogobuguxotufes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://bezujadavi.rf.gd/ludziIn macro / runtime command snippet
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f809.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF809 5096 bytes
SHA-256: db76dd075982817e5d8c3357413cb2536297517de7b3e1a5bc20901ee20624b2
font_01_sfnt_off00010957.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10957 10952 bytes
SHA-256: 508356d3319ebd86289220ae0d59a478b8767be54a48d351b4790675473373cf

Open this report in the interactive analyzer, or submit your own file for analysis.