Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e9983c1af8e0f34…

MALICIOUS

PDF

113.5 KB Created: 2021-04-24 05:29:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 40f59c22d4f8bca1f8d3833afa454d6a SHA-1: b6074e54598d1d6f59a9c010b44db0374b0b74aa SHA-256: 5e9983c1af8e0f3428c80e9ec099908eff746fb5f0fd84a55d3a5ce9dbf11e5c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a link farm designed for SEO manipulation. The primary malicious URL, 'https://xezojetit.ru/strik?utm_term=behringer+xenyx+x1622usb+manual+espa%25C3%25B1ol+pdf', suggests a lure to download a manual, likely a phishing or malware distribution tactic. While no scripts were explicitly extracted, the PDF structure and extensive link farm indicate a malicious intent to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=behringer+xenyx+x1622usb+manual+espa%25C3%25B1ol+pdf
    • http://tiktokcopyrighthelpteam.com/marshall_football_schedule_1970k8kkd.pdf
    • https://wakutoji.weebly.com/uploads/1/3/4/3/134314583/6365185.pdf
    • http://instacopyrighthelpteam.com/21912567542lfxl3.pdf
    • https://cdn-cms.f-static.net/uploads/4421940/normal_6011b3c489ff3.pdf
    • https://cdn-cms.f-static.net/uploads/4475987/normal_602f3b4f98d9a.pdf
    • https://static.s123-cdn-static.com/uploads/4460255/normal_600244181b103.pdf
    • http://arm-watch3.club/box_office_mojo_all_time_worldo6rcv.pdf
    • https://zejosawazir.weebly.com/uploads/1/3/1/8/131856185/50bcc15.pdf
    • https://farenutatovepo.weebly.com/uploads/1/3/4/5/134502273/wudinexunoxanaz_tafesituzoju_medogu.pdf
    • http://tonerinkstore.com/jowipekuxub0xpwx.pdf
    • https://static.s123-cdn-static.com/uploads/4373016/normal_600765c892f1b.pdf
    • https://cdn-cms.f-static.net/uploads/4490974/normal_5fdafef1aebba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jumedemimo/freddie_mac_condo_guidelines.pdf
    • https://932aa67c-856a-4fda-9fc8-fe3f50d4acc2.filesusr.com/ugd/a25eee_91564f4d2a48486f97f74fb906027310.pdf?index=true
    • https://19f621d4-ab03-49b5-bf1d-c78de40104d4.filesusr.com/ugd/bc84a3_d8775ba9fac543d0a745250a2c719bbd.pdf?index=true
    • https://2d2b1dae-c014-4902-97e6-c3f1d56915cd.filesusr.com/ugd/70e5f7_386df07f59834b4780b4a26dfb3d5f04.pdf?index=true
    • https://s3.amazonaws.com/tedowafomaru/28012391327.pdf
    • https://s3.amazonaws.com/vudivuzakal/what_is_the_main_theme_of_divergent.pdf
    • https://s3.amazonaws.com/jefazaxal/80596455099.pdf
    • https://s3.amazonaws.com/latufenaw/amcrest_view_pro_app_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://fsf.org/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/philosophy/why-not-lgpl.html
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecf5.bin
94c5e92dc7c3bb65d234a02af09862bbf6ff094234840efa6be34473f40215a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECF5 6364 bytes
font_01_sfnt_off0001023a.bin
354cedf792aeb53379809d3593cc9a8b490e6c4dce2aa77160493f311a6c607d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1023A 110540 bytes
font_02_sfnt_off000179c1.bin
39a41c6c0f8c36d1824cdc73425962c9f4ba77dab643d903b9639317957fe853		 pdf-font-stream PDF embedded font (sfnt) at offset 0x179C1 11716 bytes
font_03_sfnt_off0001a089.bin
1ffca1ef16be5e2ec436e77f9211a88ad3199dc781cb76600401cc2e2c7dce6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A089 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.