Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b9511d00e03d17f…

MALICIOUS

PDF

87.1 KB Created: 2021-04-07 20:05:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ee5f641b9819540da5904a15a014fa79 SHA-1: a7432199afc2bb48060418bb39ab7d365056af0e SHA-256: 5b9511d00e03d17fe7ad12d879bad3f39e4e2dc65fab010f992aea6536af7d5d
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with one prominent URL pointing to 'xezojetit.ru', suggesting a phishing or malware distribution attempt. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is designed as a link farm on disposable hosting, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=budesonide+formoterol+brand+name
    • http://wonizojaru.scienceontheweb.net/sobiwopitenagevepupijeve.pdf
    • http://roman-holidays.shop/big_little_lies_book_review709dn.pdf
    • http://fizarumokugafu.mywebcommunity.org/revenue_sharing_formula_in_nigeria.pdf
    • http://tiwujatujoput.mygamesonline.org/chordate_zoology_book_download.pdf
    • https://cdn.sqhk.co/zezoxomop/1hchihh/45525880881.pdf
    • http://warupipujamoru.sportsontheweb.net/movokifadosovonopitukuba.pdf
    • http://luxisulejoxo.getenjoyment.net/bless_me_ultima_sparknotes_chapter_2.pdf
    • https://cdn.sqhk.co/fabetojowuje/hgiezie/smash_toys_chicago.pdf
    • http://accface.in/completed_d_d_character_sheetdq9t4.pdf
    • https://cdn.sqhk.co/kolokejo/g5Pibid/83273969978.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/forupokisip/what_book_comes_after_mightier_than_the_sword.pdf
    • http://sajulugebimisu.myartsonline.com/41568603160.pdf
    • https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_5c93b6bf74b74361a1e278f23ca70927.pdf?index=true
    • http://fowakoleviwamop.onlinewebshop.net/welding_merit_badge_worksheet.pdf
    • https://b86313a8-447b-404d-ae6d-bc69740d899e.filesusr.com/ugd/e54fc7_95167df63381457a8cff83b4ae66a5f2.pdf?index=true
    • https://fa5d8e44-005d-4c05-925d-ba60cb7f5023.filesusr.com/ugd/121e37_8ee129ed6e8841d496217ee492fa5337.pdf?index=true
    • https://cc0b58a5-7bf4-4b41-9cd7-d9bc0cd2cc6f.filesusr.com/ugd/6dc98b_a370020a71ee4fada3078b4f8db9d03b.pdf?index=true
    • https://s3.amazonaws.com/toniseligiwuzux/how_much_does_it_cost_to_fix_a_tablet_charging_port.pdf
    • http://teropisarazo.myartsonline.com/mamiya_rz67_repair_manual.pdf
    • https://s3.amazonaws.com/votubukaxogilix/angular_1_file_from_web_api.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010821.bin
b0f6d2c795eca42a4003d57feff4e730b74cd70178f29a090434ddccfd4492be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10821 5124 bytes
font_01_sfnt_off00011964.bin
9a69fe86a59f2d5ac7200bdbaa3df9806636b79e8d9c1443afd38a86129602dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11964 11124 bytes
font_02_sfnt_off00013f5a.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F5A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.