Malicious PDF — malware analysis report

Static analysis result for SHA-256 3acb342821e028be…

MALICIOUS

PDF

81.4 KB Created: 2021-03-07 10:57:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2feb366ad443c37cc97a13bb3317dc7f SHA-1: ee771ad300d936fa37e253ec1f529006b61f9d46 SHA-256: 3acb342821e028be58954b064fb27c151974b096ed4f6480b749722e561d91c6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The PDF contains a large number of external links, with the heuristic 'PDF_SEO_LINK_FARM' indicating a potential link farm strategy. The primary external URI observed is 'https://vilenefex.ru/wix?keyword=truth+spell+ao3', suggesting a lure to a potentially malicious website. The document body is heavily obfuscated and unreadable, providing no direct clues to its intent beyond the presence of metadata related to 'wkhtmltopdf'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=truth+spell+ao3
    • http://lovefoxesi.iblogger.org/3233853299.pdf
    • https://cdn.sqhk.co/vuvapolaxaj/jMT56YT/king_of_avalon_wiki.pdf
    • https://cdn.sqhk.co/bamebuxi/Yjd4jis/tag_faces_ios_photos.pdf
    • https://cdn.sqhk.co/suxujaba/j2jcJ9Z/texas_longhorns_women_s_basketball_roster.pdf
    • https://cdn.sqhk.co/bogovureg/dKgfjeo/king_tommen_game_of_thrones_actor.pdf
    • https://cdn.sqhk.co/nebafaveju/igJAD4Z/33701222228.pdf
    • https://cdn.sqhk.co/posebozej/ghADig7/24253350448.pdf
    • https://cdn.sqhk.co/xamitarerivu/ILhb5he/48273989082.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wadobenozunon.rf.gd/inch_foot_yard_mile_worksheet.pdf
    • https://5bf49506-6ef1-42f8-8f90-7e3689255fd3.filesusr.com/ugd/8fe1bf_29097a150cca4d2bb18dc2f224a123c8.pdf?index=true
    • http://zetusisase.rf.gd/playtex_diaper_genie_how_to_use.pdf
    • https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_596abf4da2454856bd844782e133b5e6.pdf?index=true
    • https://bb491b24-4c81-4ccc-8daa-bf1baeb171c2.filesusr.com/ugd/93c935_9ef4ad3a1e2246d7bcd74c8f03249fea.pdf?index=true
    • http://mufomasugom.epizy.com/boridopobupixojugavujeg.pdf
    • https://da89e6ec-52f9-4c28-8de8-447a2e923c0c.filesusr.com/ugd/5e5b2a_b4698b2df54349cfa84f919c79e6ee66.pdf?index=true
    • https://30b7a97f-6117-4fff-8876-4b3c2220b6c6.filesusr.com/ugd/15cd4d_7ac7fe90d0cd4b4e91d8dddcc9265808.pdf?index=true
    • https://8ecf7690-1f99-4e28-a4b6-3228ba9731d7.filesusr.com/ugd/63d3ad_7e4d4ea51d0f4bfe89f42e0f642589d9.pdf?index=true
    • http://susodiwur.epizy.com/29785079610.pdf
    • https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_fde9e0a120e04fb5a67651fc825fbc3d.pdf?index=true
    • http://rodesodekisivu.rf.gd/arnold_chiari_malformation_patient_uk.pdf
    • https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_dbafd20c12794dd990a12cc1eda5ac00.pdf?index=true
    • https://78151a86-a557-4e49-81aa-a2539eea45c7.filesusr.com/ugd/204f4f_562548062fb9468299d2fd7d8e30ae1c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eca0.bin
713faec40b927a8644aa5c5d56f086de84282950f61d9814d12a982fb103b4cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECA0 5020 bytes
font_01_sfnt_off0000fdac.bin
f48610fc3f0fb9f2da5158b249420f0eb8192ac2b50939c0f6f93d3a5cac2590		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDAC 10544 bytes
font_02_sfnt_off000121f8.bin
4d22ba1b3e610b449dcb905967405141ca3512992eab6bb4b52bf066fb8b8ced		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121F8 16336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.