Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c7cc36d586fcb02…

MALICIOUS

PDF

73.9 KB Created: 2021-03-27 13:47:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a815e58fc65ff9ba80b0ffbf376706a SHA-1: 91eccbb2488e54c7a35c72a55bef464f8aa52522 SHA-256: 6c7cc36d586fcb024476526f283a8d00db7bc58fff793d2a013e47c504daf9df
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for phishing or distributing malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, and the 'ML_NYX_PDF_MALICIOUS' and 'CLAMAV_DETECTION' firings strongly suggest malicious intent. The primary malicious URL identified is vilenefex.ru, which is likely used to host a secondary payload or redirect to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=solving+equations+with+fractions+worksheet+pdf
    • https://cdn-cms.f-static.net/uploads/4387230/normal_602053fc922cf.pdf
    • https://cdn-cms.f-static.net/uploads/4405895/normal_602e5b04d04f0.pdf
    • https://cdn.sqhk.co/konosoka/lijcow0/lenizedakufekobowatakij.pdf
    • https://cdn.sqhk.co/vafegijateno/hiC6kPV/trap_bunny_bubbles_clean_lyrics.pdf
    • https://cdn.sqhk.co/tinupolureg/gXGmtia/xegosufevezibedozotule.pdf
    • https://cdn-cms.f-static.net/uploads/4465905/normal_6058b0fa838bc.pdf
    • https://cdn-cms.f-static.net/uploads/4459185/normal_60534cc78a2e1.pdf
    • https://cdn.sqhk.co/nawakema/06cRieP/5143572885.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ab0007c4-58ca-4db2-ab23-686bae4d53c1.filesusr.com/ugd/8bf248_42fff898ed39456bb0579a12f6ff877a.pdf?index=true
    • https://c3373aeb-ed74-4f2d-b631-fa679e0a3f6f.filesusr.com/ugd/cbe7f7_7f3a92906512472ea48fb29f33cc4071.pdf?index=true
    • https://71a0d42b-91d5-4e94-9338-ff69ca8a624b.filesusr.com/ugd/e5d5e5_efbcc2ea22c94c348d4e967558cd4485.pdf?index=true
    • https://28546a20-d0cc-4b82-bb4f-6711990cd5a3.filesusr.com/ugd/0bcf16_a89db6421b4a4cb19c70ec1fb75a7872.pdf?index=true
    • https://f84ffea9-2755-49c2-9cb5-47ca8b55fe65.filesusr.com/ugd/0adedf_8cef22f8d6344094902b99a7e221771c.pdf?index=true
    • https://1b15a19f-c8c2-4d9d-8c2f-e97aa7ecfe2c.filesusr.com/ugd/eb6c48_04c7a62997bc457b8a2dbee829ea6fac.pdf?index=true
    • https://02ee9779-94d6-4ec7-959f-c0f99fe19a35.filesusr.com/ugd/cdc607_e4c915a180934e46824f13133cd4cf17.pdf?index=true
    • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_c1a888c3332e4280ab3c8cf0affe480d.pdf?index=true
    • https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_dba5c40b93a24bf6aa081767fa3e2488.pdf?index=true
    • https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_ba88fd159bca42e2a90c34bf96299317.pdf?index=true
    • https://091a8774-b5bd-4fb7-8799-8d1ca0ca44ad.filesusr.com/ugd/8716ab_2bb6830e00154227b697cb2b8e857313.pdf?index=true
    • https://ded05c8b-f0d8-42bc-a64b-daa0b63394ca.filesusr.com/ugd/99afdc_e2b7720795c147ac8d5b49bfe4a7f2c2.pdf?index=true
    • https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_4264fd6e86334a668939e87824d2fa98.pdf?index=true
    • https://e0f910ba-f4aa-4d6b-87f6-24d78cda99ab.filesusr.com/ugd/cc15ef_883e523a69a441aeb94eb3fc28e0615a.pdf?index=true
    • https://4ad55601-b8ab-4ae0-bc0e-e90069072326.filesusr.com/ugd/3aca14_5dddd71b989b4c77b8c5c9fe4c48af19.pdf?index=true
    • https://cb0920a4-0dfc-4587-8161-bd3bf883b043.filesusr.com/ugd/df391a_cbd385f5558b42c8ae3eff5f98674c63.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3ef.bin
e4245a641d7e085dba3ca7166baa085a99968f2c57fe3eaf3708f71521698d8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3EF 5864 bytes
font_01_sfnt_off0000f7f4.bin
cbeefdba0aeeabb0987a7ae1e0e260bf4ed7546196a2fdd2918f3249480ba8a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F4 9960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.