Malicious PDF — malware analysis report

Static analysis result for SHA-256 64a093de7d89e033…

MALICIOUS

PDF

68.8 KB Created: 2021-04-05 02:15:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 7414fd98ba60e04ac2dd6f9fa54ca7d3 SHA-1: 1c0b8b577c2eb303600dc50616231cd9622c4b02 SHA-256: 64a093de7d89e033d86dfc190a82ad3d36dedd60e21d84693cd510d894c1491b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as phishing. It contains numerous external URIs, with a primary suspicious URL being https://mezovuduw.ru/wix?keyword=buena+vista+feed+store. The document body, though heavily obfuscated, suggests a lure related to a 'feed store'. The presence of multiple links and the overall structure indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=buena+vista+feed+store PDF link annotation
    • http://spainsale.pro/abhimanyudu_songs_vishal3i6ty.pdfIn PDF document text
    • http://redtea.space/how_to_get_a_roku_tv_to_turn_on_without_remote4l5zg.pdfIn PDF document text
    • https://popaxeras.weebly.com/uploads/1/3/0/8/130814769/dexakebudaro.pdfIn PDF document text
    • https://wafanipo.weebly.com/uploads/1/3/2/6/132695839/kefadaga_nelejid_mapazat_kokafivakesanur.pdfIn PDF document text
    • http://heartcenteredequestrian.com/acas_disciplinary_and_grievance_guidelinesuk5yq.pdfIn PDF document text
    • https://popetebebulexu.weebly.com/uploads/1/3/4/3/134316921/63fbb3ae9.pdfIn PDF document text
    • http://cookwellbakewell.com/biropewubozebelabimavbmmb.pdfIn PDF document text
    • https://sepuvomaxobaba.weebly.com/uploads/1/3/5/3/135311468/a604f.pdfIn PDF document text
    • http://fitness1.space/31385930547rtsqe.pdfIn PDF document text
    • https://xowiwive.weebly.com/uploads/1/3/1/3/131398234/resiwadevuku_wifulalapope.pdfIn PDF document text
    • http://teachost.com/sweat_by_lynn_nottage_synopsiska1ri.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ac967b5-768a-4dc0-8048-ec826a92a26b/vatexukuridowelun.pdfIn PDF document text
    • https://28546a20-d0cc-4b82-bb4f-6711990cd5a3.filesusr.com/ugd/0bcf16_ffc28efa547b45a8bc8692c42641f70a.pdf?index=trueIn PDF document text
    • https://08c3cc13-1ce0-4add-927e-a3aed263473e.filesusr.com/ugd/ccf397_3786fcb8e1874711ac8ba14f4e55ddbe.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/03bf1720-9a81-445b-9f52-131d3b3e9b5a/telakibufojupejejejopis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64b0bf9d-0b91-42e4-b8f6-0b493d2bac18/9793163177.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db6a34d9-ce07-415a-82e1-67104719b922/bible_quote_with_god_all_things_are_possible.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18e832a4-0770-4563-9901-d86fa727e6f9/evenflo_double_stroller_without_car_seat.pdfIn PDF document text
    • https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_3c3992bbaa4347a2919498fa75137014.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD2C8 4980 bytes
SHA-256: c6f72d520d88b114859477f967565f07f2cdbd5c144654faa200f796d2f404d2
font_01_sfnt_off0000e3ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3CE 10220 bytes
SHA-256: a18866baf5cc6812e0ce54f62171341b3dcf9b3d00a74fdd1335a93b1c12f490

Open this report in the interactive analyzer, or submit your own file for analysis.