Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c13ecee229c7607…

MALICIOUS

PDF

76.8 KB Created: 2021-03-19 05:03:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 353c1153635f87308cba0e4e014ba369 SHA-1: 52aae45ae00b99da62416aa3a1c91f99f3bcfdb9 SHA-256: 4c13ecee229c7607265f666d64f8eb4465c6e274fa9fdfc413db01b6539073d3
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating it is likely a phishing or trojan delivery mechanism. The document contains numerous external links, forming a link farm, with the primary malicious URL being https://gimoguvi.ru/aws?utm_term=how+to+turn+on+playstation+gold+headset. The document body, though heavily obfuscated, appears to be a lure related to the search query. No scripts were extracted, but the presence of many external links suggests a redirection to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/aws?utm_term=how+to+turn+on+playstation+gold+headset
    • https://duzopotubesafes.weebly.com/uploads/1/3/4/8/134890215/xesumumaterix.pdf
    • http://jerabigemoz.sportsontheweb.net/mekotilifodovizexakuxaro.pdf
    • https://vagajexaxe.weebly.com/uploads/1/3/4/3/134359414/vupujipus_jevizinetop.pdf
    • https://mudasolujo.weebly.com/uploads/1/3/4/8/134886274/2509320.pdf
    • http://zitupow.medianewsonline.com/12032069544.pdf
    • http://goxalajiwon.22web.org/bhojpuri_all_new_movie_2019.pdf
    • https://tavifarexup.weebly.com/uploads/1/3/4/6/134611028/45a24.pdf
    • http://bagomebefekixob.getenjoyment.net/the_selection_movie_netflix_kiera_cass.pdf
    • http://rolapisi.scienceontheweb.net/mewoditagizijasugadoritik.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/25a2ebee-6ea6-48b7-934b-12e8ea37b7b3/how_long_to_learn_r_language.pdf
    • http://rusobuxun.rf.gd/journalistic_report_meaning.pdf
    • https://uploads.strikinglycdn.com/files/44807e5d-d88e-4604-897a-c7635ae75b0d/how_to_get_band_9_in_ielts_writing_academic.pdf
    • https://uploads.strikinglycdn.com/files/1df6d744-a94c-449b-9c18-276fc06f34e8/67620929323.pdf
    • http://lelisavebak.rf.gd/actinomycetes_producing_antibiotics.pdf
    • https://uploads.strikinglycdn.com/files/49bebdf2-fb9b-46f6-a1b1-40e3a47f464d/pharmacology_case_studies_for_medical_students.pdf
    • https://s3.amazonaws.com/minegikukovel/jail_warder_exam_2018_answer_key.pdf
    • https://s3.amazonaws.com/defipedibe/betty_azar_understanding_and_using_english_grammar_workbook.pdf
    • https://s3.amazonaws.com/wuzalugiseto/xuxironaxazasabeluwivoje.pdf
    • https://uploads.strikinglycdn.com/files/062cc427-ef5e-4582-8a19-b9703ca14ad6/how_to_workout_with_fitness_bands.pdf
    • http://nisewizowefad.epizy.com/ligekuwokozuwo.pdf
    • https://s3.amazonaws.com/nakevoja/xibuletazuxiperavipuj.pdf
    • https://uploads.strikinglycdn.com/files/68813641-ab80-4e8f-a7c4-513799f7af41/74873635144.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee3c.bin
afdddc9ce1e38171ebb89d09b4ead79dec6c27ef6622520df6292ffdf4ff5ed5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE3C 5376 bytes
font_01_sfnt_off0001008e.bin
f7e6e87e3273ea57c4829a033fedd67e8b9472cdbebc16e059eb9fa61c99b2f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1008E 10856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.