Malicious PDF — malware analysis report

Static analysis result for SHA-256 34cf7685a7682f94…

MALICIOUS

PDF

78.1 KB Created: 2021-04-01 04:46:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 89ed09b8eeb840750a52b3d57f58722b SHA-1: ccb89fdb8b22dfcab46162bc1921188d47d68768 SHA-256: 34cf7685a7682f948b0b6f5517a8ce385016eba04e91f74a69c55f00eff702c7
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ML classification and ClamAV, indicating malicious content. It contains an external URI pointing to a suspicious domain, vilenefex.ru, which is likely used to host a phishing page or a second-stage payload. The PDF also exhibits characteristics of a link farm on disposable hosting, suggesting an attempt to obscure the true malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=emulator+nds+pro+untuk+android PDF link annotation
    • http://fafasun.iblogger.org/vaposowojome.pdfIn PDF document text
    • http://carbags.site/miboxosinufakepexezudori0dhh1.pdfIn PDF document text
    • http://tokio-2020.fun/wosomop93f81.pdfIn PDF document text
    • http://bokugoso.22web.org/74548319774.pdfIn PDF document text
    • http://questotzvezd.space/alter_ego_3_cd_audio_classesotyy.pdfIn PDF document text
    • http://prizinsta.info/how_to_edit_a_gif_file_in_gimpbajcm.pdfIn PDF document text
    • http://strapslap.online/bob_marley_greatest_hits_album_downloaddrr6a.pdfIn PDF document text
    • http://test123test.xyz/zomuzijikan7hsn.pdfIn PDF document text
    • http://docita.fun/batman_arkham_origins_cheats9asct.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c31b26d3-e954-4c7b-8e20-02f6f1befa29/petty_cash_confirmation_letter_format_in_word.pdfIn PDF document text
    • http://nanixalo.rf.gd/gozujuvuzag.pdfIn PDF document text
    • http://lifosodutevofa.epizy.com/what_is_a_sketchup_classic_license.pdfIn PDF document text
    • http://mowekejerejo.rf.gd/birotowenebaludivexiginov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48dbd126-d2a4-40c0-968f-40676abe28a8/65784355878.pdfIn PDF document text
    • http://zedizokasub.rf.gd/34555609733.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e7aa3c1-0bca-4670-913a-55220a84dc7e/tukuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b624ed3-f3bc-4f3f-91ba-07143860ed0d/digitech_vocalist_live_fx_bedienungsanleitung.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2bfcd71-e4a8-4ee3-b37f-78f7672b15f4/26783763873.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e63b15d-f2b3-4b45-b250-7ae3c3414bdf/boston_market_menu_prime_rib.pdfIn PDF document text
    • http://tefabawamibane.epizy.com/77664690226.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0f8db08-555a-42bb-8d32-09240dab3156/cissp_all-in-one_exam_guide_shon_harris.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c35c289-cefc-4b80-b6f6-b90318370fbe/23514000195.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/147971c3-3bc1-42ba-9864-62c3c0ecda4c/dadowonetoxofanedufekes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B9 5128 bytes
SHA-256: e36e9bd70e394f29ceffe92e4c4e896466e34d2c149d216f11094af9c4248394
font_01_sfnt_off0001050e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1050E 11168 bytes
SHA-256: cef33645e2501f59f5df026a3784ead17477b3fb550d13e6ba68aa6768da3d31

Open this report in the interactive analyzer, or submit your own file for analysis.