Malicious PDF — malware analysis report

Static analysis result for SHA-256 6931decd3e06454e…

MALICIOUS

PDF

119.0 KB Created: 2021-04-06 17:20:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c2200f501989c5538b104b06f2bdaba SHA-1: 7b5a10166c668e1994103ab37f3d67c43a4c9e71 SHA-256: 6931decd3e06454e762f09719250deef659ed9697c569836e600c4ac57800481
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. One of the primary URLs, 'https://xezojetit.ru/wix?keyword=crayfish+dissection+worksheet+quizlet', is directly associated with the PDF's content, suggesting a lure. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware delivery via the linked sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=crayfish+dissection+worksheet+quizlet
    • http://zifixoribe.scienceontheweb.net/haggadah_free.pdf
    • http://leadtop.co/autotune_untuk_adobe_audition_1._5f4qe0.pdf
    • http://twobigs.space/91921388613e4kbc.pdf
    • http://lapitubemexidi.mywebcommunity.org/lejugozigazokawid.pdf
    • http://dexiwakuxabef.medianewsonline.com/tunafumewasu.pdf
    • https://cdn-cms.f-static.net/uploads/4475397/normal_6069a1623b8e1.pdf
    • http://volosaty100.xyz/what_are_some_core_values_in_the_workplace1wlrm.pdf
    • https://cdn-cms.f-static.net/uploads/4412774/normal_5fd6735b4b891.pdf
    • http://tryplafond.xyz/vovatiwegjfks5.pdf
    • https://static.s123-cdn-static.com/uploads/4459170/normal_6002b82a180ad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/30a9cace-8f1b-45a0-910b-c9a77bcfaf46/zinokiwavosuva.pdf
    • https://uploads.strikinglycdn.com/files/2e7f4c88-a5b6-4ce0-81a1-f3a31d663237/kifozuworitulum.pdf
    • https://uploads.strikinglycdn.com/files/ddb62600-4c4f-4d10-be42-0d69e8bd581f/43125144268.pdf
    • https://uploads.strikinglycdn.com/files/d80f0b6f-85e0-4c60-841b-43cd7a445634/what_is_the_message_of_the_story_the_tell_tale_heart.pdf
    • http://pojoviraxerojo.myartsonline.com/51806450930.pdf
    • https://bac325b5-3710-4a60-ba01-c1ac5e8a7650.filesusr.com/ugd/c111de_324f612b093648dd9b26bb637f906ce1.pdf?index=true
    • https://cf21b241-1edd-4e7a-8b85-4b7fa12bec5a.filesusr.com/ugd/835652_0dbdaea65e9042d7b8139a080dad8d4e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/80a12b68-eaff-4a61-bffe-39dc78fbf4c6/32345649488.pdf
    • https://uploads.strikinglycdn.com/files/ce907a08-a28a-4d6f-a35a-714f4c41a156/xibitujevewafuzojar.pdf
    • https://uploads.strikinglycdn.com/files/f63f9e2f-57af-44fc-a3e6-14c58d5b24a9/every_young_mans_battle_age_range.pdf
    • https://uploads.strikinglycdn.com/files/a0316743-9ad7-46c2-af64-c493ae969c07/how_much_is_track_phones_at_walmart.pdf
    • https://uploads.strikinglycdn.com/files/9cfda711-ea1d-42f5-9ab6-cfe3f427c49c/certified_medical_assistant_exam_prep_free.pdf
    • https://uploads.strikinglycdn.com/files/2dd50436-ee81-4bba-ae6b-f863e6dda2a5/82290166070.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018a8d.bin
f52648b81538291d5e089d3c3fb516446f9f0eac8e2713234aaa78a33b35c15c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18A8D 5448 bytes
font_01_sfnt_off00019d26.bin
51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19D26 1800 bytes
font_02_sfnt_off0001a5b4.bin
285f8b4edea2cc11f5b8e5ca6d7186bdbc6b57ca13e31910f267e410ca83af0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A5B4 11204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.