Malicious PDF — malware analysis report

Static analysis result for SHA-256 73ae07b14b0a7ad5…

MALICIOUS

PDF

65.4 KB Created: 2021-03-26 13:17:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 72d342edccad9a72bb28d651d54aa4cc SHA-1: aef14b3288f4c1e343f722e782952c6cff2b8050 SHA-256: 73ae07b14b0a7ad551be5f6655324a32ded0156701950194a39e97e25d86f176
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is part of a link farm, with numerous external PDF links. The primary URL, https://mezovuduw.ru/award?keyword=marine+boilers+flanagan.+pdf+free+download, suggests a lure for a technical document. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9474

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=marine+boilers+flanagan.+pdf+free+download
    • http://memakumiri.iblogger.org/army_of_the_damned_dd_campaign.pdf
    • http://jidinovivapo.22web.org/29825273186.pdf
    • http://lomizagin.iblogger.org/google_material_design_guidelines_images.pdf
    • http://goranefadosire.iblogger.org/vocabulary_list_for_ielts.pdf
    • http://new-leggins.site/elements_of_arts_in_egyptian_sculptureez9xi.pdf
    • http://navalny.design/golexezedebipemexoda24pzt.pdf
    • http://qrettalq.online/391375212605ootq.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xomepixo/rilisipi.pdf
    • http://jubadoloje.epizy.com/lenizuvalifodibogo.pdf
    • https://5121d360-3808-4f61-aa44-d87cf2d9d428.filesusr.com/ugd/032e8a_6028d8361a384411afdcea5608e4b4a5.pdf?index=true
    • https://47e244ab-6b1f-4ae7-97e8-86de5b619f9f.filesusr.com/ugd/e1d12c_ad9e26cd029f417faaa2bfb8562bb799.pdf?index=true
    • http://wiwabapanap.epizy.com/1999_jeep_grand_cherokee_owners_manual_download.pdf
    • https://s3.amazonaws.com/satulibaren/free_editable_recipe_template_for_word.pdf
    • https://s3.amazonaws.com/fizufapu/why_is_the_apocrypha_not_in_the_bible_got_questions.pdf
    • https://s3.amazonaws.com/wazorixekunafob/nicholas_sparks_books.pdf
    • https://f8d82b49-d438-4da2-b906-f876cb6fe635.filesusr.com/ugd/12dc78_41d9b7239d94425d9f12d993c354451a.pdf?index=true
    • http://logaraba.rf.gd/zuzejemube.pdf
    • http://rosedosoxibi.epizy.com/64728563880.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ce73.bin
4b35d94396dbd8436a1b7f569277ea1fc2914dda96a499c045e4eec9c07c4943		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE73 5188 bytes
font_01_sfnt_off0000e027.bin
610aa04bc3bf3d67e04b9e0bc66ba660b88ed948c208757783ec1410ff88ea3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE027 10992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.