Malicious PDF — malware analysis report

Static analysis result for SHA-256 34578d629abf1b5c…

MALICIOUS

PDF

88.2 KB Created: 2021-03-20 10:48:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f71098a110b14db4677b49a34932a03 SHA-1: 3155892b5cd9c21feeba85d25dfdc6877a69853a SHA-256: 34578d629abf1b5cb1ec94ff5fa924f69b9a7adc5a86101837083328479114ae
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is classified as malicious by ML and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, directing users to numerous domains, including the suspicious 'vilenefex.ru', under the guise of workout information. The presence of many disposable and link-farmed domains suggests an attempt to obfuscate the true malicious destination and distribute the threat across multiple low-reputation hosts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=strength+training+anatomy+workout
    • http://dmdmassage.com/76947494720ms4yj.pdf
    • http://jerimujolegem.medianewsonline.com/24191263399.pdf
    • http://lastasked.com/meme_generator_pro_patched_apk6nnjr.pdf
    • http://garobunatuxovi.scienceontheweb.net/patas_arriba_eduardo_galeano_descargar.pdf
    • http://pufegusikozig.22web.org/how_to_turn_off_the_alarm_on_a_timex_expedition_watch.pdf
    • http://rasudilikid.mywebcommunity.org/wuvolejiso.pdf
    • http://jawazapefaxuzit.mywebcommunity.org/bible_quiz_questions_for_kids.pdf
    • http://pshcomonhere.xyz/hp_envy_7640_setup_instructionszlamn.pdf
    • http://blog-millionaire.buzz/70378902863hd0ql.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://goziwofa.rf.gd/pimavowojinifafusiti.pdf
    • https://3d7304b5-8527-495f-b913-615d6f357a43.filesusr.com/ugd/ef7486_528e0908181c497c9f23d822a5c9b63d.pdf?index=true
    • http://resilasijajatil.myartsonline.com/how_to_rig_a_live_bait_for_bass.pdf
    • http://gegenig.epizy.com/alt-_r_crispr-_cas9_guide_rna.pdf
    • https://e29f0852-aa8c-4fc4-a5db-fcd144ab7086.filesusr.com/ugd/b730be_122791d243ff46168f7f77eb33972434.pdf?index=true
    • https://uploads.strikinglycdn.com/files/49523bfc-1a3a-4b6f-827e-b2199adc71c1/beluzoturuxuli.pdf
    • http://tirinito.epizy.com/99369053280.pdf
    • https://uploads.strikinglycdn.com/files/6ee4bdfb-0144-47b5-abcc-b2df0c4cb21a/xisiwep.pdf
    • https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_554657ba418047a3a9758e7588006ea9.pdf?index=true
    • http://najijojovigom.myartsonline.com/nodufujokisujowamu.pdf
    • https://22fea36a-5e19-4af1-b4aa-fe6e1efe0ee9.filesusr.com/ugd/b5a188_b7271be721e44c008eb52e4f143d066c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e95.bin
851390ef1987131bbc48653ced118e28a6fa63ef2e4372aebd2145404a353960		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E95 5132 bytes
font_01_sfnt_off00011fe6.bin
520bf44df96022186c2a676886b86a81856b5e79242746cd80808b9a89f7b9de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FE6 10980 bytes
font_02_sfnt_off0001454a.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1454A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.