Malicious PDF — malware analysis report

Static analysis result for SHA-256 359bc555f3844217…

MALICIOUS

PDF

80.7 KB Created: 2021-03-22 11:45:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6df03ac1812ff04d80e20c845332162e SHA-1: d58793d9ee9f7e9421aa467b94b1b94420d7c95e SHA-256: 359bc555f384421736961404ae7901dce77e48c9fe7fa577f11280765a7d8e0e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO poisoning tactic. The primary URL, 'https://xezojetit.ru/wix?keyword=sonic+4+episode+2+apk+full+free+download', indicates a lure for software downloads. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=sonic+4+episode+2+apk+full+free+download
    • http://xuvaxujogilo.mygamesonline.org/tooth_fairy_audrey_wood.pdf
    • https://cdn.sqhk.co/xegunorasu/jRhg8lw/download_pes_club_manager_2020_for_pc.pdf
    • https://cdn.sqhk.co/lukulobu/hi4WFtx/dunkleosteus_skull_size.pdf
    • http://gutibefatidag.medianewsonline.com/87309683190.pdf
    • https://cdn.sqhk.co/wadelovelo/Ykjhwtg/5648595120.pdf
    • https://kekufekogaj.weebly.com/uploads/1/3/4/7/134768560/6649823.pdf
    • https://jikumudepopojet.weebly.com/uploads/1/3/1/4/131453433/901932.pdf
    • https://cdn.sqhk.co/kisesawaropo/GsignEY/my_lips_are_swollen_and_peeling.pdf
    • https://cdn.sqhk.co/dekavaka/hfhdhan/loop_video_firestick.pdf
    • http://vixemifojetinag.sportsontheweb.net/academic_journey.pdf
    • https://cdn.sqhk.co/tawumemikuva/migmaha/cycle_time_improvement_guidebook.pdf
    • http://xugaguf.mypressonline.com/zivodipalodemo.pdf
    • https://cdn.sqhk.co/puzukebejas/yhbhjhe/xuletuzowavi.pdf
    • https://cdn.sqhk.co/jabakujivim/5A2idig/80009204805.pdf
    • https://cdn.sqhk.co/madagijoj/eidrIii/poker_hands_learn_poker_free_download.pdf
    • http://pexulisinipev.sportsontheweb.net/55180335860.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zorijefugixor.atwebpages.com/matejavimumab.pdf
    • http://muvekalufisu.atwebpages.com/xifazefa.pdf
    • https://uploads.strikinglycdn.com/files/b45f7219-6e9b-45dd-adfa-92130d48d262/11179384314.pdf
    • https://uploads.strikinglycdn.com/files/2cd9ca81-da27-40c7-a342-b654d0ed0ee9/what_is_the_synonym_of_lethargy.pdf
    • https://uploads.strikinglycdn.com/files/16badb10-5c9e-4158-8464-4e6f021273c8/besekur.pdf
    • http://gozuketitara.onlinewebshop.net/la_familia_de_pascual_duarte_resumen_completo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec16.bin
929a7ef426859df5cde6ad76eae929f1ff7c013798c637267d881c351395da83		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC16 5432 bytes
font_01_sfnt_off0000fea1.bin
2458735e31ff822a7f438fcd19c804617a05891bcbe3a09176515e3b13d5a9b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEA1 11812 bytes
font_02_sfnt_off00012718.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12718 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.