Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e15e29ea08cc028…

MALICIOUS

PDF

75.7 KB Created: 2021-04-28 11:42:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 5554ff47c6c500b937d57525d55c3f17 SHA-1: dd37aa2015a7ac83d8e3d920a7805bc02fcde898 SHA-256: 3e15e29ea08cc02898b7b1fce682a50a5642adadb1d2fff421ac904a6bebceaa
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a high number of external links, many of which point to potentially malicious domains, as indicated by the PDF_SEO_LINK_FARM heuristic and the ClamAV detection. The primary malicious URL identified is https://soxebez.ru/strik?utm_term=black+%2526+decker+the+complete+guide+to+plumbing+pdf, which is likely used to redirect users to a phishing or malware-hosting site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=black+%2526+decker+the+complete+guide+to+plumbing+pdf PDF link annotation
    • http://leziwazedo.mypressonline.com/yamaha_677_receiver.pdfIn PDF document text
    • http://zuxekagapefe.mygamesonline.org/busosefosaxedaze.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_895bb68458cd4f40b2304e102b7ee7d8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/173046f6-a161-4f65-9673-f677e4c905a0/7_day_mental_diet_audiobook.pdfIn PDF document text
    • https://729282ec-1290-4cbc-9302-cf8a24acd4c7.filesusr.com/ugd/42c189_c0df48cb00be4f4d8a5e03a78e048459.pdf?index=trueIn PDF document text
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_7f4c4f37741e4e0d86f2070a0fa81dd8.pdf?index=trueIn PDF document text
    • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_1ccc31a6e2d34edbaf1a294d88bc8ba2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wazotojemov/brian_tracy_goal_setting_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/xeroguru/54854082620.pdfIn PDF document text
    • http://forezepolutaju.onlinewebshop.net/vovujotokazaponowefadexu.pdfIn PDF document text
    • https://s3.amazonaws.com/gisujubolidine/15410392476.pdfIn PDF document text
    • https://s3.amazonaws.com/bevarolimesale/10435425899.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a6da37f-ca20-483d-90db-194f91239097/mirozatabunalavu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36b73894-ac93-4d28-99d5-f48eda6d54db/norelco_9000_cleaning_instructions.pdfIn PDF document text
    • https://s3.amazonaws.com/genukopapovixo/how_to_execute_c_code_in_python.pdfIn PDF document text
    • https://c145ee04-3c3b-4786-8b94-e0511401b322.filesusr.com/ugd/de65f7_3a893544d41d4c48b7cdce71ef26a035.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gurafoga/lean_on_me_emiway_bantai_song.pdfIn PDF document text
    • https://0fe83ef2-ed6b-4f04-a52d-31fe3c58d8d1.filesusr.com/ugd/ade4e6_2bbc92af9e6e46ed8beaf2ae016b245f.pdf?index=trueIn PDF document text
    • https://7a579b3f-ce96-4c66-abdc-991530493d29.filesusr.com/ugd/010c6b_77ae31ee1fd94d4cb40c448f3875c8f8.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED44 4624 bytes
SHA-256: 566d7ec229a88bc76631eb4f1593514476e7cf78c9d57cd033be42071c200118
font_01_sfnt_off0000fd0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0E 10780 bytes
SHA-256: 399b8fe981ffa376a58adbb65d35f3b1b699b69f18cb167b6f8bf7777a72124b

Open this report in the interactive analyzer, or submit your own file for analysis.