Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dce90c43e21d4fa…

MALICIOUS

PDF

101.4 KB Created: 2021-03-19 14:19:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7e8a997a74929b0442effd5814536d86 SHA-1: 699341a904a467477a1c0aafa11dce6458493845 SHA-256: 7dce90c43e21d4fa0a67756519b642d06b8958e8a40ddaeb0c4d7f7ec43ef79e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are SEO-themed and point to other PDFs, suggesting a link farm or redirection mechanism. The primary URL, 'mezovuduw.ru', is presented as a search result for accounting homework, a common lure for phishing or malware distribution. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=cengage+accounting+chapter+5+homework+answers
    • https://cdn-cms.f-static.net/uploads/4462345/normal_6009e51eba211.pdf
    • https://cdn.sqhk.co/lilomovetum/ieCgcjb/rabbit_s_magic_adventures.pdf
    • http://muzhskoizhurnal.ru/bratz_bunny_boo_logoz2iec.pdf
    • https://cdn.sqhk.co/sidamebo/uywgjSG/mibubujawuxosin.pdf
    • https://sozuxope.weebly.com/uploads/1/3/4/8/134873608/tubarizig-zujod-tifej-mapelubokudizal.pdf
    • https://cdn-cms.f-static.net/uploads/4466657/normal_6032cd504fe3b.pdf
    • https://xisulufi.weebly.com/uploads/1/3/4/8/134870666/seter.pdf
    • http://shoop-ff.ru/best_portable_clothes_steamer_2020wcg5t.pdf
    • https://cdn.sqhk.co/kunimoxifagi/Ajxjbhj/paxeneguwefo.pdf
    • https://static.s123-cdn-static.com/uploads/4446399/normal_5ff7682ad715b.pdf
    • https://cdn.sqhk.co/takabalal/higJ4Wx/accidente_cerebrovascular_hemorragico.pdf
    • https://static.s123-cdn-static.com/uploads/4478703/normal_5fe1f9abc4938.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d6b7b3c7-8429-4d82-9d75-5d5d09e763cc.filesusr.com/ugd/a8c229_5fc96eb76aa746f0ac7196985fd819a1.pdf?index=true
    • https://091a8774-b5bd-4fb7-8799-8d1ca0ca44ad.filesusr.com/ugd/8716ab_d16356538a9f4264b6a99433b299e402.pdf?index=true
    • http://tuzevuvenadeg.rf.gd/pijiw.pdf
    • http://leniwijob.epizy.com/76743136645.pdf
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_9471d6347aee4646b51284985c829146.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00015c1c.bin
8dd4cbf7e204a395fc33c933435e1d9833bcf9e7d3a78b1393243572f974e337		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15C1C 23304 bytes
font_00_sfnt_off0001204c.bin
11121420c358d9840f6ba935057abbfd4576d1858ec1495ccec0cf29727cdc07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1204C 5500 bytes
font_01_sfnt_off000132f0.bin
6c12f868a47d77a1e31336d0f1308c575d324ef20f273eb844f4c9ae48c0db0a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132F0 12004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.