Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d315ee342c86158…

MALICIOUS

PDF

75.7 KB Created: 2021-03-16 15:16:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a14ac3e92d6cecb02137291f902e9ad5 SHA-1: bfa902415e64bf40f9ccd56f6f81047492b71fb0 SHA-256: 4d315ee342c86158ed167ccfc8dbe7cdca5166fbd432aa6714634ea586e852cf
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a significant number of external links, identified by the 'PDF_SEO_LINK_FARM' heuristic, pointing to various domains. The 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' heuristics strongly indicate malicious intent, with ClamAV identifying it as 'Pdf.Phishing.Trojan'. The embedded URLs, such as 'https://xezojetit.ru/123?utm_term=zedge+ringtones+app++free', suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=zedge+ringtones+app++free
    • https://vavavutexe.weebly.com/uploads/1/3/4/4/134441002/zetixinubixotokod.pdf
    • http://xifadezuzurap.medianewsonline.com/tokemox.pdf
    • https://cdn.sqhk.co/zidulibu/fjb6Plt/kung_fu_commando_2020_new_fighting_games_2020.pdf
    • http://xijonofupawulo.mypressonline.com/blog_libros_romanticos_2020.pdf
    • https://cdn.sqhk.co/jumifokujuje/hhhcsZF/tanks_royale_2d_battle_royale._io.pdf
    • https://cdn.sqhk.co/konosoka/0jhfMji/grandmother_gifts_near_me.pdf
    • https://cdn.sqhk.co/gotakavapu/xigiehf/shipwrecked_movie_review.pdf
    • https://cdn.sqhk.co/tezikegoj/jiJjbif/bad_genius_malay_sub.pdf
    • https://cdn.sqhk.co/kibukiwovi/hBthaqn/organic_chemistry_aldehydes_and_ketones.pdf
    • https://siselujasukoju.weebly.com/uploads/1/3/0/9/130969984/4870393.pdf
    • https://cdn.sqhk.co/moserusoba/5njcqic/five_below_bugha_gaming.pdf
    • http://nipawifaxupus.mygamesonline.org/adrian_newey_how_to_build_a_car.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4db5a2da-71fc-4d02-887c-6e93dc053167/zenewegowujexujime.pdf
    • https://s3.amazonaws.com/suxugipipolazog/piriformis_syndrome_symptoms_runners.pdf
    • https://s3.amazonaws.com/sutawowirosuvuv/county_government_act_kenya_law_reports.pdf
    • https://s3.amazonaws.com/jasipefulaxiduj/how_to_use_h1n_recorder.pdf
    • https://uploads.strikinglycdn.com/files/ceab7a8d-0b75-48a6-8737-307d51793c53/jemuzifupegozavawe.pdf
    • https://s3.amazonaws.com/befarekogol/vocabulary_practice_activities.pdf
    • https://uploads.strikinglycdn.com/files/bec9f683-8ec4-4e7a-a0df-43c699f424a6/xoxujojitigagoto.pdf
    • https://uploads.strikinglycdn.com/files/9533bace-c438-405a-abe8-c9de032681ec/4571228361.pdf
    • https://s3.amazonaws.com/woxorojero/84910107973.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebd9.bin
028e8f4ac27d04341ac0a7dc4cf46a980e6ef4729b91aabbe2bd21c9e067dc1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBD9 5132 bytes
font_01_sfnt_off0000fd6a.bin
86c692b3ddbf01ac1880d87621dd885a73e1ff81ceab5a40543163eb29edc332		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6A 10536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.