Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e0ef72ae0118a85…

MALICIOUS

PDF

73.5 KB Created: 2021-03-22 13:27:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 780cfde3d1372ed6de4cf5a8250605e6 SHA-1: befb867132620c4f6fe6bdfe4b0a8ed4c406c174 SHA-256: 2e0ef72ae0118a852d507de09cd885b34f1bab445d6f06926664b5952235419e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical finding for a large number of external PDF links, suggesting a link farm or SEO spam campaign. The primary external URI points to a URL that appears to be part of a keyword-driven content generation scheme, likely intended to drive traffic to malicious sites. While no scripts were explicitly extracted, the PDF structure and extensive external links indicate a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=pearson+prentice+hall+answer+key
    • https://zukusabaxiwig.weebly.com/uploads/1/3/4/0/134000387/2697874.pdf
    • https://cdn.sqhk.co/pofaxiniraz/jghcih7/shake_shack_menu_prices_riyadh.pdf
    • https://cdn.sqhk.co/xupebasolaw/SpPgcWg/two_way_relative_frequency_table_worksheet.pdf
    • https://cdn.sqhk.co/vanewano/hgfijso/zodutenujovojubomowidijuv.pdf
    • https://cdn.sqhk.co/monasomeb/WZLSmuw/used_drag_box_for_sale.pdf
    • http://likelid.xyz/filizigirujujisikomexikow9nw.pdf
    • http://dhl-order.info/bosch_1617evs_parts_manual89aq3.pdf
    • https://cdn.sqhk.co/fokivetezabu/hjhdbrE/female_halloween_costume_amazon.pdf
    • https://kuratoso.weebly.com/uploads/1/3/4/3/134329811/bezumonuv_neremorozopomu_fuxonera_famorexawosofox.pdf
    • https://cdn.sqhk.co/vitimosugu/qibidgc/dual_sword_build_albion_online.pdf
    • https://cdn.sqhk.co/mezugifosa/hiAi5hi/93946179849.pdf
    • https://cdn.sqhk.co/bafiweba/OO5hajf/20690688938.pdf
    • https://cdn.sqhk.co/xoluxuroku/igjhhv7/ringtone_maker_for_iphone._app_free_download.pdf
    • https://jufavufopu.weebly.com/uploads/1/3/4/3/134340263/8924404.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/ladojenefe/the_myth_of_sisyphus_quotes_explained.pdf
    • https://s3.amazonaws.com/gagagakigibapo/petorajuwaluze.pdf
    • https://s3.amazonaws.com/pibajuwi/gimadopevozopexoxizixu.pdf
    • https://43fe4710-460a-4ad3-90dc-2dd795c51528.filesusr.com/ugd/a32c20_5144940c63224e75ae61fa8534b8cd66.pdf?index=true
    • https://44f39d5c-a655-4437-91b6-62b11e148e71.filesusr.com/ugd/eb4c03_e20f302a2c674b0bad1d2853459c1722.pdf?index=true
    • https://a2ae8793-a99f-480d-a3bc-849ef63d34f7.filesusr.com/ugd/cc207a_e08ce76b7fc14a11ac2ca47cb08176d9.pdf?index=true
    • https://s3.amazonaws.com/mibiwivanetuj/65293454760.pdf
    • https://18cceff7-6d50-42ec-9d85-67184b61345e.filesusr.com/ugd/8c2e83_1ce3a341b65e49a29213399f9292dcfa.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d765.bin
45213ca0efc3273fa640173d9ce2bce64faa7534636d96b62b9f0062bc11dc36		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD765 5068 bytes
font_01_sfnt_off0000e8a5.bin
64833264d47e6f6a74322e8a4ec128ccd75369a1595427465f97547bb976baa6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8A5 9784 bytes
font_02_sfnt_off00010a1d.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A1D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.