Malicious PDF — malware analysis report

Static analysis result for SHA-256 58b91891d321c7ec…

MALICIOUS

PDF

81.9 KB Created: 2021-03-15 19:46:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ffb058b1190a9ea63b3e56b2a23470e6 SHA-1: 7f2a8113c4e4d46f56cc604a777d3cd06ad6ef33 SHA-256: 58b91891d321c7ec8886a8a7960350686eef746555063a0239b99a0adaaab716
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting it functions as a link farm or phishing lure, with one prominent URL being https://mezovuduw.ru/wix?keyword=the+legend+of+zelda+majora%2527s+mask+unblocked. The document body, though heavily obfuscated, references game-related terms, likely to attract user attention.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=the+legend+of+zelda+majora%2527s+mask+unblocked
    • http://sentytld.online/towagumukitojizuruwarinezoevio.pdf
    • http://mojenisijita.mywebcommunity.org/merrill_lynch_mortgage_refinance_rates.pdf
    • https://cdn.sqhk.co/besimiwi/d0hg95F/79561982593.pdf
    • https://cdn.sqhk.co/bopesajan/geiegdJ/sumavozusiwisotuwadojap.pdf
    • https://cdn-cms.f-static.net/uploads/4384820/normal_6036c813c55f1.pdf
    • https://static.s123-cdn-static.com/uploads/4383916/normal_5ff53f9a9fd48.pdf
    • http://kogejirupu.getenjoyment.net/sipuzidirunitoginadado.pdf
    • https://cdn.sqhk.co/purovufizu/RUtltIh/bomubojipesu.pdf
    • http://talakam.space/17784966398wsl4g.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/1aa024e5-716c-4c0d-a849-846b5030f9b1/14323959993.pdf
    • https://uploads.strikinglycdn.com/files/d3486b15-d447-41c0-8ffe-4f21575fca99/varavitezufitabuladosev.pdf
    • http://kijonag.onlinewebshop.net/suromusoliwoka.pdf
    • https://29ce6865-365c-47c4-9f0a-635d6f965865.filesusr.com/ugd/0d6b77_92f4a7fbc04e4b48a3713bf0599eba9d.pdf?index=true
    • http://nopugorib.onlinewebshop.net/smart_wristband_app.pdf
    • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_31565441f17645d4a337253c7af6586d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/59118230-43e1-4d2e-af59-185662dd4a57/44079235177.pdf
    • https://uploads.strikinglycdn.com/files/37efc84f-1a39-4c61-8f5e-078f31a210f9/how_much_is_toyota_sienna_2006_model.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0de.bin
e6930e760a553e5437c4b1166cb55c32b96ea8b874f8704e8d8961ff0e65e1a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0DE 5504 bytes
font_01_sfnt_off0001037d.bin
d4be6d22a3f47038430583ae5026917b4984113e760c0d7ea0758d4bd1d14cbc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1037D 11404 bytes
font_02_sfnt_off00012a1e.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A1E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.