Malicious PDF — malware analysis report

Static analysis result for SHA-256 455c48914b68743a…

MALICIOUS

PDF

76.7 KB Created: 2021-04-05 15:50:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 724d4096c375db81cab8c813ac89f1f0 SHA-1: 5f79f3a9731f0e3084d7d2284851664f7562008c SHA-256: 455c48914b68743adb5b2ac2a0836d05dd2ee90c953c37adc7346e1ec8b0cd29
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing indicating a link farm with external URIs, specifically pointing to 'https://vilenefex.ru/123?utm_term=annexure+e+passport+word+format'. This URL is likely used for phishing or to host malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=annexure+e+passport+word+format
    • https://cdn.sqhk.co/madagijoj/FhiJdjh/snake_plant_soil_needs.pdf
    • https://cdn.sqhk.co/sigidezok/eijjhAw/vovevokotakofenidorutugib.pdf
    • https://cdn.sqhk.co/wolebiduju/lifyXC3/24060439868.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ade2de82-9a0c-444e-9681-904ac45b511b/foxoxos.pdf
    • https://uploads.strikinglycdn.com/files/d33a37d5-965c-466c-98ef-1db30f101035/bigefedometa.pdf
    • https://0c7b1e5d-10e9-4c66-9a64-57e6babc74f3.filesusr.com/ugd/6b59ba_c0afcd3ea97245a98cff7fd77d98b6f0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9ee42b5b-c299-4443-b0e2-c2cd31c41c35/how_to_insert_character_count_in_word.pdf
    • https://uploads.strikinglycdn.com/files/168acf4a-e70a-4398-ac74-6a1dc9ee83cd/lonag.pdf
    • https://s3.amazonaws.com/rubidokezive/zevuvowotufoxinorerof.pdf
    • https://s3.amazonaws.com/vuliwisuwig/android_gba_emulator_gameshark.pdf
    • http://wozawexopad.epizy.com/how_to_teach_symbolism_to_high_school_students.pdf
    • https://uploads.strikinglycdn.com/files/86008e86-66e4-4a0b-96c3-bafe3fcb8896/80976910714.pdf
    • https://2ddedb0e-b7b0-41c9-a8bc-c018bd0e6e4c.filesusr.com/ugd/70094d_27cf8af3ae4d452fb217c1cfef6b5a51.pdf?index=true
    • https://uploads.strikinglycdn.com/files/710609c3-5c86-44b6-af44-c00b3909909f/73759116898.pdf
    • http://silapopo.epizy.com/weniru.pdf
    • http://puzegekizizovin.epizy.com/nom_factores_psicosociales.pdf
    • https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_bdcfaffec82b47e99fc35a8da40b10c6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/05cc7b92-70b8-4c20-88c3-37b6b14794f9/25464386191.pdf
    • https://uploads.strikinglycdn.com/files/097555f5-911e-4123-82aa-2e8d48f37f02/xudifinavubanavazoravi.pdf
    • https://c79dcb07-c1b1-4d84-a600-6417d8bf0f54.filesusr.com/ugd/edce22_dc4d47fb7d8b4feaaa1f6998bb0d11b6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efbb.bin
808f8cfe9973c8a2cea06ecd665d7a9ebd2f843734b95f484f89239168e7e6c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFBB 5304 bytes
font_01_sfnt_off000101c8.bin
404b73a55aeb78945a5d3bec4d263aae69616f6a61e77267728ce07d55d4be95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101C8 10444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.