Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b5b79ded1ab2db9…

MALICIOUS

PDF

79.3 KB Created: 2021-03-14 10:08:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c67bd038b4ce274ee0aa4ca63624c71 SHA-1: 1ff700684555e48c89aaa5c938d210731ded0c98 SHA-256: 7b5b79ded1ab2db9480c24409c794353ada33e96239da5a2f6cbee10283957ef
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, and a specific external URI pointing to 'xezojetit.ru'. The ClamAV detection and ML classifier strongly indicate maliciousness, classifying it as Pdf.Phishing.Trojan. The presence of embedded URLs and the overall structure suggest a phishing or malware distribution attempt disguised as a printer setup guide.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=lexmark+x4650+setup+without+cd
    • https://cdn-cms.f-static.net/uploads/4420030/normal_6011d79e79402.pdf
    • https://static.s123-cdn-static.com/uploads/4482848/normal_5fc5d64d6c577.pdf
    • http://vuvuga.xyz/gary_hood_auto_clickerul599.pdf
    • http://shoppermarket.online/fozebufubij3vt0a.pdf
    • https://cdn-cms.f-static.net/uploads/4490140/normal_604d016453a9e.pdf
    • https://cdn-cms.f-static.net/uploads/4469104/normal_6019a8b7b5707.pdf
    • https://static.s123-cdn-static.com/uploads/4495855/normal_5ff59be50bb15.pdf
    • http://summ-ita.space/backup_android_contacts_to_pc_via_usb5gpil.pdf
    • http://vozivovog.scienceontheweb.net/47879243452.pdf
    • http://salebox.shop/asterisk_cdr_reports_free748e0.pdf
    • https://cdn-cms.f-static.net/uploads/4483103/normal_600ae7f7134c6.pdf
    • http://stepka2016.xyz/aasia_bibi_case_judgement_in_urduqrue1.pdf
    • http://mujabelor.mywebcommunity.org/dabusevugu.pdf
    • http://wofaguwere.iblogger.org/33212211472.pdf
    • https://cdn-cms.f-static.net/uploads/4374853/normal_6013ba5028518.pdf
    • https://cdn-cms.f-static.net/uploads/4462727/normal_6015e39088232.pdf
    • https://static.s123-cdn-static.com/uploads/4454420/normal_5feb01364da28.pdf
    • http://jixewelo.scienceontheweb.net/87510626424.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_109f7a6fb0a14f48b04d1b863432cfb1.pdf?index=true
    • https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_281bfb6f3c974946bef441de85e48ab9.pdf?index=true
    • http://pakebixulo.epizy.com/test_de_inteligencia_emocional_para_nios.pdf
    • https://42190e62-4dca-482d-a077-ae7b222d7779.filesusr.com/ugd/b91392_9630b178a8ac4f1a8a0423e7da2173f6.pdf?index=true
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_2b431f45e12f4649a30251e7d56a6211.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f554.bin
74073269a821ad564482ff918853597710148fd8e9f28ef1117df79e43ef7469		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF554 5952 bytes
font_01_sfnt_off0001098f.bin
76cceed0755394b3bbe2e28b5bde7db3ce47b4c9c752c8fbd6fffa47a1994666		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1098F 11328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.