Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b79c29a38b35a8f…

MALICIOUS

PDF

79.4 KB Created: 2021-03-30 13:33:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 463c1b2fd5988a7baeb01d8d9f33b204 SHA-1: c4098431caef87d00679792f152189cb99a139c3 SHA-256: 2b79c29a38b35a8f08ce87c81a462e8ad70719b27338a7805b447b033fe820ae
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. It contains multiple embedded URLs, with one prominent URL pointing to 'mezovuduw.ru' and associated with a lure for an 'emulator app'. The PDF's structure and numerous links suggest it functions as a link farm designed to redirect users to potentially malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=bnsf+emulator+app+android
    • http://shopee24.site/52281725958xnh38.pdf
    • https://cdn-cms.f-static.net/uploads/4412570/normal_605f94a651288.pdf
    • https://cdn-cms.f-static.net/uploads/4421062/normal_604dac7d22656.pdf
    • https://static.s123-cdn-static.com/uploads/4423460/normal_5fecc71b76c30.pdf
    • http://vekowen.getenjoyment.net/fajutopovujopiw.pdf
    • http://mozaduz.mygamesonline.org/alimentos_altos_en_hierro.pdf
    • https://cdn-cms.f-static.net/uploads/4449603/normal_600f7c6007ceb.pdf
    • http://flymoney.net/36906549508w64hs.pdf
    • https://cdn-cms.f-static.net/uploads/4409818/normal_600aebd8e3a84.pdf
    • http://xajabuzowa.scienceontheweb.net/cathode_ray_oscilloscope_notes.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://6a421494-2577-4416-904f-e17348f56b63.filesusr.com/ugd/85e76a_fd908f3500e44562909fdacf77027bbd.pdf?index=true
    • http://sakigekoxigukil.epizy.com/ikea_australia_catalogue.pdf
    • https://ef5e9b3f-1a8e-4c79-9b60-34b8f8133c96.filesusr.com/ugd/18574e_46d4805686b742e78a678eca97875add.pdf?index=true
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_8107c09a1c114de7a49807e8657aece5.pdf?index=true
    • http://tolitaxolumupu.rf.gd/46789797316.pdf
    • https://229c3593-bb94-4e5d-9b9f-ca3747df48ef.filesusr.com/ugd/145364_3405434b4cee45f1862ae37c46d06e8e.pdf?index=true
    • http://jitawidavez.atwebpages.com/ritumixelufakoziwiz.pdf
    • https://c06d174a-caca-4ab2-b5a0-4525cd3135d4.filesusr.com/ugd/856cea_3a78d0af9e6547179bf92613a17fb7b6.pdf?index=true
    • http://fataragoreb.myartsonline.com/types_of_chemical_bonds_worksheet_answer_key.pdf
    • http://foperibonar.rf.gd/lands_end_catalog.pdf
    • http://zixaxonenugoko.epizy.com/19_anexos_oaci.pdf
    • https://www.bnsf.com/bnsf.was7/emu/main
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea5d.bin
2c618db3d5c93675210952ea2a45328d43fa40c3ebb28f67fa55a8e7f31f6658		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA5D 5116 bytes
font_01_sfnt_off0000fba5.bin
afab56bf45983b0072672d05486a93f840503ebb270a68e40adabdef6801a87d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBA5 11360 bytes
font_02_sfnt_off0001222d.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1222D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.