Malicious PDF — malware analysis report

Static analysis result for SHA-256 340e264cf01d50ab…

MALICIOUS

PDF

75.0 KB Created: 2021-03-20 20:10:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5935ff45c9bc18e29775960b9e7ad4bd SHA-1: b1e43f98c18940515436542827da074b3e893460 SHA-256: 340e264cf01d50ab77c7b2398bedbd2b36bf322b2692fc8571f346410721481e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, with ClamAV identifying it as a phishing trojan. The embedded URLs, such as https://xezojetit.ru/award?keyword=ugly+duckling+short+story+pdf, are likely used to redirect users to malicious sites for phishing or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=ugly+duckling+short+story+pdf
    • http://ranupila.mywebcommunity.org/ctet_sanskrit_question_paper_2020_download.pdf
    • http://detonic-deutschland.website/43766468989pwukx.pdf
    • http://sumapewub.getenjoyment.net/fazufel.pdf
    • http://pasetbs.xyz/netgear_dgn2200mv2_manualk10j1.pdf
    • http://joritirumag.mypressonline.com/dedozavug.pdf
    • http://giwapozolaleg.mypressonline.com/soleus_air_conditioner_window.pdf
    • http://rivalo130.com/dewalt_dw745-xe_pricevzqt0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/044f6cf4-1669-42fa-89a9-89cd26d8b093/reddit_best_body_language_books.pdf
    • https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_6868c25420274e26bd2bd11f898bf3e8.pdf?index=true
    • https://64b67c6e-fbbd-4787-add8-9ed3e274c95c.filesusr.com/ugd/eb6612_5c8149867789411d8af844552968d3e6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8a0c8942-5250-4006-820a-d884d7163bd8/free_wordpress_ecommerce_themes_2020.pdf
    • https://uploads.strikinglycdn.com/files/1852d7a2-ee53-45e2-b1dc-b1d36abaf515/gifoz.pdf
    • https://uploads.strikinglycdn.com/files/b6401f60-1400-4470-a4eb-68aa0cf8a0cd/pepasofopanefixixuj.pdf
    • https://c1cb471f-fc5c-4ef2-b3e1-4d0d0d09d135.filesusr.com/ugd/cc5b41_7058b7dbd60c4bc2bd63ea9aa6ea4bbc.pdf?index=true
    • http://zugepoguj.onlinewebshop.net/coordinate_plane_worksheets_7th_grade.pdf
    • https://uploads.strikinglycdn.com/files/412b7a87-a3e0-47df-b8fa-839611c731dd/zebufevatuvebar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e79d.bin
6c4b7823121b28eb0da5a1612211dac8173f603b3eed4caf78b884c66659bfd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE79D 5364 bytes
font_01_sfnt_off0000f9ec.bin
be98c5f1034fd4462a91c396b3e7e604bc45224513830e8e27fddda761cc2669		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9EC 11020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.