Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e820b4e3dffb765…

MALICIOUS

PDF

68.8 KB Created: 2021-04-05 07:19:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5051377034279de826619c9fd85f7307 SHA-1: dc69ed72c524d069c0416d2e036cfbaddf73d50a SHA-256: 2e820b4e3dffb7655184ebd73b61f2bdf7ab203c0665dcbbf9eda68c73ced9f5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents. One of the primary URLs extracted is https://xezojetit.ru/strik, which is likely part of a phishing or malware distribution campaign. The ClamAV detection and ML classifier further indicate malicious intent, classifying it as Pdf.Phishing.Trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=radio+shack+electronics+learning+lab+kit+28-280
    • https://cdn.sqhk.co/zemakojunil/gij3lwh/siren_head_nightmare_scary_horror_games_online.pdf
    • http://ideal-it.fun/203689854618nftq.pdf
    • https://cdn.sqhk.co/gilubibawi/1ghjdii/sketch_drawings_paint_funny.pdf
    • https://cdn.sqhk.co/pasededi/hagiFMz/iowa_high_school_football_schedule_2020.pdf
    • https://cdn.sqhk.co/bozogekeji/agfjdgi/girly_swot_memo.pdf
    • https://cdn.sqhk.co/zasemewiti/eMaFEpd/cialdini_influence_book_summary.pdf
    • https://cdn.sqhk.co/fifapupifig/cjg89ie/xasapikawogudezovavele.pdf
    • https://cdn.sqhk.co/gexedamej/zjaBBZ8/lepufaxewafefopa.pdf
    • http://reassurez-moi-fr.info/414112791918f49e.pdf
    • https://cdn.sqhk.co/zujubokave/IClicjh/teacher_apps_for_distance_learning.pdf
    • http://ibkreactiva2020.com/best_brand_identitym5jgj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5a995288-ce6f-4ae3-a3e6-14272d8003db.filesusr.com/ugd/7be1cd_89a3fc6639ed4776851d623060d51212.pdf?index=true
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_fc0bcc562c4d41389dbd6c73ee78cda8.pdf?index=true
    • https://6f847715-c85a-45d9-ae5c-7c68cc800588.filesusr.com/ugd/6e100b_f225217292ab43c094d687a5e426be28.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d41f9afe-8d9f-4057-8252-a71f9a365523/mugufekomidi.pdf
    • https://uploads.strikinglycdn.com/files/2c587f3a-4662-4fe0-90de-c315ef510687/punctuation_worksheets_high_school.pdf
    • https://uploads.strikinglycdn.com/files/ea89c071-3ac5-4129-9e99-28786e7150c7/kilozepikatewa.pdf
    • https://uploads.strikinglycdn.com/files/0e165966-1d8e-43dc-be14-c302269a1b04/who_makes_double_drawer_dishwashers.pdf
    • https://uploads.strikinglycdn.com/files/6a972cbd-7e06-4ffd-bed1-32bcd4a364b3/19359807311.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cfa9.bin
0d941dd5575e89a8505575d8e85f72a8417d08519a95a31d5251726e24d58929		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCFA9 5912 bytes
font_01_sfnt_off0000e3c4.bin
6493195d49a630213e0790000132e7d934de532a5283dac73d555f6be590e1d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3C4 9852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.