Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f93544a244d6932…

MALICIOUS

PDF

87.4 KB Created: 2021-04-26 22:06:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d47130395874f98ba9ff741972b01320 SHA-1: 4fe4740c244faff4ef860a3958dde05af7155ec9 SHA-256: 7f93544a244d693231c3b2c065287092c0441e0117617c294bf73b8bb1ab38b4
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one specifically pointing to a suspicious domain ('vilenefex.ru') that is likely used to host malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, suggesting an attempt to distribute malicious content or engage in SEO abuse. ClamAV also detected this file as 'Pdf.Phishing.Trojan'. The presence of a link farm and a phishing/trojan detection strongly suggests a malicious intent to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=city+of+bones+tv+series+trailer
    • http://xovijezup.mywebcommunity.org/programa_de_ingles_preescolar_aprendizajes_clave.pdf
    • http://monstergym.ru/windows_10_for_free7m6hk.pdf
    • http://wolorarozuxa.22web.org/53354352003.pdf
    • https://zujanotoze.weebly.com/uploads/1/3/4/4/134476942/613d33.pdf
    • http://jojidasusesot.sportsontheweb.net/adobe_reader_offline_installer.pdf
    • https://dagakaxogofawi.weebly.com/uploads/1/3/4/6/134699425/vuvisolefasikatedam.pdf
    • http://dmgameplan.com/winnie_the_pooh_classic_book_seto4wr7.pdf
    • http://vutunema.mypressonline.com/67955349369.pdf
    • http://chategratis.online/black_spiderman_wallpaper_in_hdo6602.pdf
    • https://vonepegoparopew.weebly.com/uploads/1/3/4/3/134352316/jekig_zakexedupizives_wurupukubev.pdf
    • http://madamzero.com/misavakovuoj4db.pdf
    • https://bigadamedoje.weebly.com/uploads/1/3/1/3/131384249/1960204.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fokapikow/ffvii_strategy_guide.pdf
    • https://s3.amazonaws.com/didowugorokirug/kakezapexasimoj.pdf
    • https://s3.amazonaws.com/kevava/group_4_answer_key.pdf
    • http://pibusobi.epizy.com/tusajefin.pdf
    • https://s3.amazonaws.com/palikuvexake/86396245463.pdf
    • https://s3.amazonaws.com/nelizenejakarug/balarama_digest_in_malayalam_free.pdf
    • http://nopobakuso.epizy.com/75138382509.pdf
    • https://s3.amazonaws.com/bojafazes/satyanarayan_bhagwan_ki_katha_song.pdf
    • http://zitadufafasid.onlinewebshop.net/thinking_in_java_download_4th_edition.pdf
    • http://sojetabusat.rf.gd/rinalededamemakiwobe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000118be.bin
5f51544ea8d452edb0afe864bcc880f2875a2c013a6472ade7398b1257e0c50a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118BE 4968 bytes
font_01_sfnt_off000129c1.bin
31d055182feb8ca4548c8be57eb6bb6ef12356e616722279460c5c7f21cfa3d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129C1 11496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.