Malicious PDF — malware analysis report

Static analysis result for SHA-256 53592b52f459adc0…

MALICIOUS

PDF

75.7 KB Created: 2021-06-04 23:49:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8df31cb3c190619a0680b21b63465a4d SHA-1: d86cdf46540fc8438a3a5e38460da0af4aff2d4f SHA-256: 53592b52f459adc0c538d1b69756ef4ad0728f88cf193d10e5adb186bb0b90dc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent link pointing to 'https://xezojetit.ru/wb?keyword=introduction%20to%20agricultural%20economics%205th%20edition%20pdf'. This URL, combined with the heuristic 'PDF_SEO_LINK_FARM', suggests a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wb?keyword=introduction%20to%20agricultural%20economics%205th%20edition%20pdf
    • https://sisemukogonutop.weebly.com/uploads/1/3/4/2/134266332/34f26.pdf
    • https://vevinobe.weebly.com/uploads/1/3/4/4/134487659/gezikovisuwu.pdf
    • https://merasata.weebly.com/uploads/1/3/1/3/131378960/mupaw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rukutuxeriro.pbworks.com/w/file/fetch/144551727/you_can_negotiate_anything_by_herb_cohen_free.pdf
    • http://dipazuwawex.pbworks.com/f/largo_al_factotum_piano_voice.pdf
    • http://sagidetubi.pbworks.com/f/skull_island_birth_of_kong_tamil_dubbed_movie_download.pdf
    • http://jozeluwofe.pbworks.com/w/file/fetch/144425793/examen_de_matematica_para_primer_grado_de_primaria.pdf
    • https://uploads.strikinglycdn.com/files/24046532-797f-4c07-ac20-d206c70ece98/kapu_kuialua_fight.pdf
    • https://uploads.strikinglycdn.com/files/52421c1b-f326-46d3-a651-6d89c17e3688/dikuxoxopaxi.pdf
    • https://uploads.strikinglycdn.com/files/b10c2c0e-98f2-41ca-97b2-beb9b91d0ac7/realtek_hd_audio_manager_not_working_windows_10.pdf
    • https://uploads.strikinglycdn.com/files/45517b6c-ce99-413d-8227-e130bbcddf90/85067095409.pdf
    • https://uploads.strikinglycdn.com/files/7fe71be7-221e-4427-8992-237e3b579b78/bokusobabisasafunajugeboj.pdf
    • http://kunozulig.pbworks.com/w/file/fetch/144547479/98566088480.pdf
    • https://uploads.strikinglycdn.com/files/a82fa3f2-18c0-4a94-99d1-7fdf56da31bd/how_to_use_the_ifruit_app_for_gta_5_online.pdf
    • https://uploads.strikinglycdn.com/files/a4a57db1-5b8e-4632-9c86-6caee0082635/lajusiduvuxufevo.pdf
    • https://uploads.strikinglycdn.com/files/c04c8253-c2bb-4660-a937-feeb637aaa92/factory_reset_iphone_6_plus_without_icloud_password.pdf
    • https://uploads.strikinglycdn.com/files/ea1e65da-2be6-49f2-8ce4-71d1b117aebc/samsung_bluetooth_keyboard_vg-kbd2000_manual.pdf
    • https://uploads.strikinglycdn.com/files/9c0cc7b7-9483-40d5-8292-338295511a5b/how_to_reset_a_hitachi_smart_tv.pdf
    • https://uploads.strikinglycdn.com/files/51cdc3f1-42df-4283-b483-ba85d78b94b7/99003079621.pdf
    • https://uploads.strikinglycdn.com/files/8da4c9af-9b8b-45c3-bb00-0a754a9348c3/how_do_you_take_apart_a_little_buddy_heater.pdf
    • http://ronefete.pbworks.com/f/29612162729.pdf
    • https://uploads.strikinglycdn.com/files/ef9bc51b-cecc-4309-8960-d0fcb1b2b9c9/jepefujevafekal.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7f8.bin
339b24b1c6229c108c8713e2127ae5ad28eb4798264bf02dc5829862a3cbaf67		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7F8 5632 bytes
font_01_sfnt_off0000faf8.bin
ad56370032eed596ee0979ba38cd87696a0655bf5a9bfec43f1d26ca84018acd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAF8 11136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.