Malicious PDF — malware analysis report

Static analysis result for SHA-256 64afb195a1354ca8…

MALICIOUS

PDF

76.1 KB Created: 2021-03-24 07:40:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 526b06af0260d49ae44a5c8ca8bb17d7 SHA-1: 7efeb504543a34c0d0c346763fbec343002ee5fa SHA-256: 64afb195a1354ca8555d7e63398650487d5c1c1c3cf23acff44691b4889295a8
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains multiple obfuscated links, including one pointing to 'vilenefex.ru', suggesting a phishing or malware distribution attempt. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. ClamAV detection further confirms its malicious nature, classifying it as 'Pdf.Phishing.Trojan'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=cinema+4d+manual+pdf+download PDF link annotation
    • http://italy50wow.pro/witcher_triss_nudecl778.pdfIn PDF document text
    • http://prosucre.pro/95594794822r3gzm.pdfIn PDF document text
    • http://xtina.online/70556344596zef7g.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479454/normal_60235e6f54e86.pdfIn PDF document text
    • http://snail-case.store/gowabugopalibudipen7hak.pdfIn PDF document text
    • http://prizinsta.online/88902591375v1kwg.pdfIn PDF document text
    • http://naturaitalia.space/best_books_for_learning_stock_market_investing10oul.pdfIn PDF document text
    • http://creditactive.info/70377564107zsvm2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467577/normal_60345e143de07.pdfIn PDF document text
    • http://lg-copyright.com/561663345284y7zi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374211/normal_6018dc1f2a27f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://8cff94d3-ecab-4ea5-ad27-d3e67d02fd32.filesusr.com/ugd/2813e2_38e638b634c649daa4b217380b26a00e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dusubonifu/mipigirugedoliz.pdfIn PDF document text
    • https://s3.amazonaws.com/bizamesuwepe/nikiwogova.pdfIn PDF document text
    • https://3f735f5a-cd1c-4288-bd93-adeff6e084d9.filesusr.com/ugd/bcc0e4_ac2fcc494e494631a6d3edc33e5270e3.pdf?index=trueIn PDF document text
    • https://7f993087-45f6-41f4-96e5-9dcaca18fb91.filesusr.com/ugd/9a92dd_811b43e022704c609c79f316f463b7b8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/risisipajole/83327044036.pdfIn PDF document text
    • https://s3.amazonaws.com/vipuxafol/763409683.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9b95dd3-4627-4a4d-a414-b7a73d1b0b05/meaning_of_seasonal_variation_in_time_series.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1db3e0c-6406-45ac-b062-e067aa97ec35/how_to_cite_website_reference_in_apa_style.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecc1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECC1 4996 bytes
SHA-256: ce8ee3abe63d8c4a2cd79a5de31fafca2f44f28fc5b793b1173971ef4dc1a3df
font_01_sfnt_off0000fdc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDC7 11032 bytes
SHA-256: 6874fd9c2178fd5b332c6403e84d891559a2b9e24dc5f5822bebf35b3b2ef5e0

Open this report in the interactive analyzer, or submit your own file for analysis.