Malicious PDF — malware analysis report

Static analysis result for SHA-256 36ac7667463ba5a9…

MALICIOUS

PDF

72.5 KB Created: 2021-05-31 06:29:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b186502b97f55d06a122f888d5e4a3d SHA-1: 7aecfa2e4885c9fd1a863f2a3d876b57583f3539 SHA-256: 36ac7667463ba5a98b51c5f4769f7ff1fd00d0aa9edf7d72b3e5a1db8f83d38f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO abuse for malicious purposes. The primary URL, vilenefex.ru, is likely a phishing or malware distribution site. While no scripts were explicitly extracted, the PDF structure and heuristic firings strongly indicate malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=possessive+nouns+worksheets+3rd+grade+pdf
    • https://fosozofafeg.weebly.com/uploads/1/3/1/8/131856121/nijifusoragos.pdf
    • https://rofekituluz.weebly.com/uploads/1/3/2/3/132303072/9404512.pdf
    • https://ximesadi.weebly.com/uploads/1/3/0/9/130969353/lelepukaladojazeb.pdf
    • https://zanebereraba.weebly.com/uploads/1/3/4/4/134472179/banego.pdf
    • https://devigafaviv.weebly.com/uploads/1/3/4/6/134698058/godiwezugovapus.pdf
    • https://komojagalon.weebly.com/uploads/1/3/4/8/134885500/8624908.pdf
    • https://gatuxarujesij.weebly.com/uploads/1/3/5/2/135296766/2034576.pdf
    • https://gaviwejijeto.weebly.com/uploads/1/3/3/9/133997776/xuvivujobawomed_lulusuvizu_marunalapovu.pdf
    • https://kofasarafafe.weebly.com/uploads/1/3/5/3/135390193/bulotesave_debagepabot_lejinopa.pdf
    • https://tediditapudet.weebly.com/uploads/1/3/4/6/134693156/jeduwixanimujamoz.pdf
    • https://lunudarekilaxaf.weebly.com/uploads/1/3/4/3/134315691/f34ea82db87d.pdf
    • https://kubuvapag.weebly.com/uploads/1/3/0/7/130776206/gitotuje_mexasesi_zobazudefulawow.pdf
    • https://gowoxavakuf.weebly.com/uploads/1/3/4/7/134702457/6599414.pdf
    • https://sajenaviwabawi.weebly.com/uploads/1/3/4/2/134266368/5053015.pdf
    • https://xinorexuvon.weebly.com/uploads/1/3/4/6/134608307/vitefoge.pdf
    • https://vewifofuk.weebly.com/uploads/1/3/5/3/135394013/sodikuzal.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/cbbef24f-ce5a-45af-94ca-a2e337d84bb9/partituras_de_piano_principiantes.pdf
    • https://uploads.strikinglycdn.com/files/20d77e05-8bb5-4062-945e-9802eac257e6/22217287868.pdf
    • https://uploads.strikinglycdn.com/files/5c3e89c5-0ec7-4de6-b414-93551c76d769/59269498658.pdf
    • https://uploads.strikinglycdn.com/files/221b0061-2e7b-426a-8a3d-10de11a36c5c/93199198330.pdf
    • https://uploads.strikinglycdn.com/files/3a95af69-7ac3-4210-9cbc-fc75594c75b0/earl_nightingale_lead_the_field_mp3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d09d.bin
53660f481ff4460b7846e3ef3d83e5e9a956321fa8a399702fecca93961d1cd7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD09D 5532 bytes
font_01_sfnt_off0000e37b.bin
c55c36095d32aef124f288a2f2e15cae36533451f010e51858b1d7d5de92eed5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE37B 10192 bytes
font_02_sfnt_off00010667.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10667 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.