Malicious PDF — malware analysis report

Static analysis result for SHA-256 438a71084ce93000…

MALICIOUS

PDF

76.4 KB Created: 2021-03-11 15:19:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb1200aed9b86952f7eb8c88505f4893 SHA-1: 2a65b4c208127ab7ccdcffb5fb584a40bfb52fe7 SHA-256: 438a71084ce93000d4100a1b87ad492b39af5133a3000c1ed48c0ebc13acf851
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm designed to direct users to potentially harmful websites. The primary URL identified, https://mezovuduw.ru/aws, appears to be the entry point for this malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=what+animals+overproduce
    • https://static.s123-cdn-static.com/uploads/4420431/normal_5fe1b00aebd87.pdf
    • https://static.s123-cdn-static.com/uploads/4422918/normal_5feff441c92ed.pdf
    • https://cdn-cms.f-static.net/uploads/4370304/normal_602cf0a52b06f.pdf
    • https://cdn-cms.f-static.net/uploads/4417129/normal_604662096d138.pdf
    • https://cdn-cms.f-static.net/uploads/4374984/normal_602c79e16b1cd.pdf
    • https://cdn-cms.f-static.net/uploads/4464070/normal_5fe66c64dc91d.pdf
    • https://vusubidasezojix.weebly.com/uploads/1/3/5/3/135399418/bf9ded97817.pdf
    • https://funotagikaxu.weebly.com/uploads/1/3/1/8/131857914/676e257fbc0d9b9.pdf
    • https://tewamuwomipatus.weebly.com/uploads/1/3/0/9/130969874/4158948.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/12eeaa15-d32e-432a-a981-8f65816bb77f/tivufosawiwon.pdf
    • https://uploads.strikinglycdn.com/files/9b35b5f8-7a82-497f-97ad-b9e613192409/pewukanufupisonisug.pdf
    • https://0fe83ef2-ed6b-4f04-a52d-31fe3c58d8d1.filesusr.com/ugd/ade4e6_4d98b8f10f5e4be3aa87026e3e34ed8c.pdf?index=true
    • https://ad9f1622-e3b7-49db-bfef-326c48fb2104.filesusr.com/ugd/a467d2_7bcf2cbb73f048c7831802d360607735.pdf?index=true
    • https://uploads.strikinglycdn.com/files/68eb6077-dafd-475e-a8b8-2c37545f1762/39633282091.pdf
    • https://uploads.strikinglycdn.com/files/9b6152be-72cf-4a7a-99c2-238772e9ee38/gomewitujoze.pdf
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_92a4ad2582d0479c9ac3257232b1731f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee2a.bin
9bab67b5b6c9f6b9d9a7cee824baf265a9bbf3c57b8c7c94253af894f2f13d08		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE2A 5388 bytes
font_01_sfnt_off0001005d.bin
2750438a131638c7e1365e7c80c49a90fba3a5e7dc84d5f04a85b8badc125ac0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1005D 10664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.