Malicious PDF — malware analysis report

Static analysis result for SHA-256 614e0ad3e0706d51…

MALICIOUS

PDF

93.7 KB Created: 2021-03-11 12:06:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2580dffcc88a0ee1fc0c4ada3992c647 SHA-1: 78bae4788c60d2fabdbe35abd70d672cb110be53 SHA-256: 614e0ad3e0706d519744f7222ed080e99e3f81c0b26b3484186f4e5c1d815417
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-optimized titles, suggesting a link farm designed to attract users. One of the primary URLs, 'https://mezovuduw.ru/award?keyword=autocad+3d+book+pdf+download', is associated with a heuristic firing indicating a potential phishing or malicious download attempt. The ClamAV detection and ML classifier further support the malicious nature of this file, likely serving as a lure for malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=autocad+3d+book+pdf+download
    • http://jisuvakuwiraza.medianewsonline.com/nasedoxupigaregepewedubez.pdf
    • http://xovijezup.mywebcommunity.org/52673568687.pdf
    • http://vawevubigawuti.22web.org/flat_stomach_exercises.pdf
    • http://forisawidokomor.sportsontheweb.net/multivariate_gamma_distribution.pdf
    • http://zugapuvu.mywebcommunity.org/56397290157.pdf
    • http://zuxekagapefe.mygamesonline.org/agricultural_production_economics_textbook.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vavejijitatofu/kafka_definitive_guide_github.pdf
    • https://uploads.strikinglycdn.com/files/934fce35-9ca6-4a0c-bab6-b97ffce351c2/napud.pdf
    • https://uploads.strikinglycdn.com/files/b075520e-bbeb-4772-b4c0-37b9046612c1/whats_better_apple_or_orange_juice.pdf
    • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_58316422c3a14f92abc1e3aa23dd1d1f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d1ee8473-3ef0-49d7-85e9-3ea1a07a5a76/how_to_connect_sony_wh-1000xm2_to_computer.pdf
    • https://uploads.strikinglycdn.com/files/40311b7e-dfe7-4f58-b281-cd05c59a0247/windows_10_brightness_hotkey_not_working.pdf
    • https://9df6fdd8-df71-43fb-87ad-b121b2de7416.filesusr.com/ugd/e0d0cf_833c7a00756b4e449877756890c23c55.pdf?index=true
    • https://dec4a425-646e-450a-80ca-a73a75d058ad.filesusr.com/ugd/ba3095_112f668f3552407582f589549fd5eedf.pdf?index=true
    • http://gamupuzif.epizy.com/zuraliluju.pdf
    • https://s3.amazonaws.com/fuvidokibet/tidegokawili.pdf
    • http://jidibavozajo.epizy.com/visualising_solid_shapes_class_8_worksheets.pdf
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_8118757b808b451c97c621f95017b9ff.pdf?index=true
    • http://gosaduzunake.myartsonline.com/behringer_x32_manual_em_portugues.pdf
    • https://e0ff2378-281a-4ea3-95ae-419c526fdc99.filesusr.com/ugd/0baf77_4d176d29d9bf455eb5fd30328f9efad2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a2b7aaa5-5705-4e19-a538-e31764544b4e/dofidevawugoxufobakutoga.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011bd6.bin
96100b3865beb2f921175f3fb7cb1abd6da03fd31488234cb4f762068c87529d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BD6 7172 bytes
font_01_sfnt_off000133a2.bin
4720ddabe428f7ae9434307ed8b28b09dbeff4fc9c908bac52d4588acdcf1d69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133A2 5324 bytes
font_02_sfnt_off000145ec.bin
a2d0f1eed294bcd48837945d0f3f5ff3aea2a9b9b2e44f47111e11f86d0189b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145EC 10244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.