Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ec7a8f2f22d018a…

MALICIOUS

PDF

76.0 KB Created: 2021-03-16 19:59:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 33bd3fa1cee4bd60727f9bd1479aa7f7 SHA-1: 2c3acded332f88ba001fe2820ed5b468f9da0262 SHA-256: 7ec7a8f2f22d018ab122a6c4835d1759664f5676f07b19ef5facc369d1bac4c5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious phishing content. It contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results or redirect users to malicious sites. The primary malicious URL identified is https://resalured.ru/123?utm_term=projected+balance+sheet+format+in+word, which is presented in a context suggesting a lure for financial information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=projected+balance+sheet+format+in+word
    • https://murafasonuralab.weebly.com/uploads/1/3/5/3/135398902/5636482.pdf
    • https://cdn-cms.f-static.net/uploads/4366633/normal_60267be9ae900.pdf
    • https://cdn-cms.f-static.net/uploads/4413846/normal_6029d62a55c63.pdf
    • https://cdn-cms.f-static.net/uploads/4482671/normal_600f2442c82ab.pdf
    • http://kimujedat.mygamesonline.org/classroom_management_in_urdu.pdf
    • http://tokudujadi.medianewsonline.com/6411420830.pdf
    • https://piwetidij.weebly.com/uploads/1/3/2/3/132303123/vigek-linafa-sotek.pdf
    • https://suwurivuta.weebly.com/uploads/1/3/0/7/130775320/1502538.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://93dbb2ad-f1e8-4c6c-adfd-2ef134399473.filesusr.com/ugd/df4650_b353e9465e0442b5b97c7a5ccd92c3a5.pdf?index=true
    • https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_c0c0ca9658ef41378379d72f5777cafb.pdf?index=true
    • https://39c10a3a-92c6-412a-a1bb-b8a1fc48fbc4.filesusr.com/ugd/259099_9993ea39026341fca49d9186a94ea724.pdf?index=true
    • http://bixozebaxikapos.atwebpages.com/94591695273.pdf
    • https://d4508431-0eee-4913-ac2a-2ec907ed9b18.filesusr.com/ugd/12daa7_4751cb34ebe849289cdae023a4c5fb55.pdf?index=true
    • https://662517ce-f374-4037-aebd-99b1dbe00103.filesusr.com/ugd/0c4177_1eaab0fd02f64b24b278f7fe5ea13b1d.pdf?index=true
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_013dddad99734f4ebd99acb0add406e7.pdf?index=true
    • https://89e5ed4a-33eb-42a6-b5f1-9fc07ea1e15b.filesusr.com/ugd/ff68bb_9d71b53d19d24b059fe4c6504ebb7e04.pdf?index=true
    • https://aca56392-15ae-48e8-982c-fdf6c4ac0dc3.filesusr.com/ugd/00c070_6cb204bd81bb4ab1a67b8a27a4328a36.pdf?index=true
    • https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_1321062da7504eaf9c67e8ac3b7b0a5f.pdf?index=true
    • https://33c7e2ec-32fc-4676-a642-9d95a4379e01.filesusr.com/ugd/622218_7796924ca5e04144843749f07ba89ff3.pdf?index=true
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_dbe951059a5346b8b2123892d7aecc2e.pdf?index=true
    • https://f85e9a30-dbb9-40fd-a66d-53bd7daafe07.filesusr.com/ugd/1b9faa_3b875daa77ce4b0e824e8ce9ac0bfa74.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ece4.bin
89c3d9783d6669c0f9b52cd174abb96efa46bb45b080ce92ceabff97bc83fb27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECE4 5572 bytes
font_01_sfnt_off0000ffb6.bin
8b70a7831ed6b19da51ee329fa6fd646e18a49d19cb10691235f55a748f8df92		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFB6 10144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.