Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f1a4a48b0f80c40…

MALICIOUS

PDF

72.9 KB Created: 2021-05-11 01:12:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5f2ed9f0af2298497c48b2b599420f48 SHA-1: 6469ef41ffbfa5a7d03ff71c84e8dc5b6ac5d2d4 SHA-256: 7f1a4a48b0f80c403d96e8d0f02074003044a0ed89d9c2f013bbf8ce890a26de
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. One of the primary URLs, 'https://vilenefex.ru/strik?utm_term=integration+of+secx+tanx+with+respect+to+x+is', is directly associated with the malicious verdict. The ClamAV detection and ML classifier further support its malicious nature, suggesting a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=integration+of+secx+tanx+with+respect+to+x+is
    • https://nekurunezofadi.weebly.com/uploads/1/3/4/8/134892804/vefejufamofotifizaj.pdf
    • https://cdn-cms.f-static.net/uploads/4393020/normal_6049d86fe911f.pdf
    • https://cdn-cms.f-static.net/uploads/4488560/normal_603c26954ef8a.pdf
    • https://pozemake.weebly.com/uploads/1/3/0/7/130776760/1d77201409db3.pdf
    • https://cdn.sqhk.co/vazoguzo/eIWXljj/classic_cafe_racer_motorcycles.pdf
    • https://cdn-cms.f-static.net/uploads/4407302/normal_604acb5ca2d49.pdf
    • https://static.s123-cdn-static.com/uploads/4454673/normal_5fee2a3ed4020.pdf
    • https://xejoxobufedad.weebly.com/uploads/1/3/3/9/133997298/8290814.pdf
    • https://cdn-cms.f-static.net/uploads/4474218/normal_603aed506fa67.pdf
    • https://cdn.sqhk.co/gituridewo/9jtjYjd/archery_master_3d_castle_defense_hacked.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/577e874a-f22a-428b-ab59-c56f45d45e20/fasosub.pdf
    • https://uploads.strikinglycdn.com/files/b4f26f36-c236-475c-8406-7c286d20b9b5/how_do_i_turn_on_my_jawbone_jambox.pdf
    • https://uploads.strikinglycdn.com/files/3d6e6a7b-bf21-473c-9a52-b2020e06dee1/vanudukejaginesu.pdf
    • https://uploads.strikinglycdn.com/files/d69b8115-1469-4df0-b512-e0ddfcdef027/50402223800.pdf
    • https://uploads.strikinglycdn.com/files/56c17dc2-fc06-4a88-ad6b-5f931bb0530d/tezokibojagonebobatabiko.pdf
    • https://uploads.strikinglycdn.com/files/420d7aa1-1cb6-48b1-a42b-cd5848d04a70/what_state_has_the_highest_prison_population.pdf
    • https://uploads.strikinglycdn.com/files/e17c93a0-636e-45aa-a8d4-56ec1c3c8202/the_holy_quran_english_translation_by_maulana_muhammad_ali.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de30.bin
bae7a31e918ed9800b01e93183227c9fde79d292f7c0a6c572855e26237b51e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE30 5344 bytes
font_01_sfnt_off0000f07d.bin
d5a6c3510fce0b0d1f133b43b0dc237cf00063806976cd22cf310a8af6306456		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF07D 10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.