Malicious PDF — malware analysis report

Static analysis result for SHA-256 839ec3d9ec31a6cb…

MALICIOUS

PDF

83.3 KB Created: 2021-04-03 18:23:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 33790da698d1d81a3fdd95bbc74c8855 SHA-1: 7d2250bb1e8fd5aaf672f27e35c8a6f10e94fa58 SHA-256: 839ec3d9ec31a6cba3b369a8b049a8f44f15c147feb6bca991c030a599f6bd26
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting a phishing or malware distribution attempt. The primary URL points to a search result for a movie, likely a lure to attract users. ClamAV and ML classifiers also flagged this file as malicious, specifically as a 'Pdf.Phishing.Trojan'. No scripts were extracted, but the structure indicates a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=mah+e+mir+full+movie
    • https://xazulifego.weebly.com/uploads/1/3/4/7/134727283/zozozuxol_satiselejewenud_movemefunajeki_bigeporilofa.pdf
    • https://serewutedirafam.weebly.com/uploads/1/3/5/3/135339767/2039780.pdf
    • https://gimitowogavu.weebly.com/uploads/1/3/4/7/134746983/lajexoro.pdf
    • https://judozonax.weebly.com/uploads/1/3/1/4/131454501/lamosedafitufifago.pdf
    • https://static.s123-cdn-static.com/uploads/4454286/normal_5fed99683b477.pdf
    • https://wojamoze.weebly.com/uploads/1/3/4/4/134479738/75ffb717e.pdf
    • https://zojozonamu.weebly.com/uploads/1/3/1/4/131438692/5436436.pdf
    • https://static.s123-cdn-static.com/uploads/4374682/normal_5fff439fa31fd.pdf
    • https://rixukiwifezi.weebly.com/uploads/1/3/5/3/135392959/nefewitumudivod.pdf
    • https://xijafidul.weebly.com/uploads/1/3/2/3/132303061/rovipaxeloxu_wolimarenad.pdf
    • https://xesuxikoju.weebly.com/uploads/1/3/4/0/134095833/df947bec2a92c59.pdf
    • https://cdn-cms.f-static.net/uploads/4421468/normal_601d247877ab1.pdf
    • https://nozijuga.weebly.com/uploads/1/3/4/6/134698325/64121.pdf
    • https://tagudosalanuku.weebly.com/uploads/1/3/1/4/131452811/95abaf6633.pdf
    • https://cdn-cms.f-static.net/uploads/4427287/normal_601ac955824cf.pdf
    • https://xewidepomizexas.weebly.com/uploads/1/3/0/7/130775014/tipopokabuw-goked-xuwisuje-loxig.pdf
    • https://xorapuwo.weebly.com/uploads/1/3/0/8/130873927/c36a4b2.pdf
    • https://xesaranit.weebly.com/uploads/1/3/2/6/132696194/5576427.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ff19a39e-637c-4fc6-80cc-750024e8dd37.filesusr.com/ugd/d217e2_be04a0c8b26947ebbb2800b1d6a8e966.pdf?index=true
    • https://2178e3ec-2e0a-46e0-af35-d8a6fdfeb21a.filesusr.com/ugd/c411cf_dad42dcc5a8d4225821bc14878dc6af9.pdf?index=true
    • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_a87313f543074d3fb7a1b46c1db49e07.pdf?index=true
    • https://b2d1eea7-aef5-47fc-962c-88b5513ecafc.filesusr.com/ugd/3a57bc_96faeb78153543ac9f56c3994b2f4932.pdf?index=true
    • https://858e1da1-ad31-4e5b-aec0-89c59c6c71f6.filesusr.com/ugd/6240f8_98c036b1f51e43afb05823518d857456.pdf?index=true
    • https://f1cb2ec4-a82d-4768-8a06-5236a2db220e.filesusr.com/ugd/a2e20a_772b7156104d4e80ad79f134477aa05f.pdf?index=true
    • https://952d9f4b-853a-4e85-af28-23c4d489d487.filesusr.com/ugd/8db125_16322564a6ef44f7a32d6dee31454b66.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f15f.bin
a514d7e8a44997e2527ce16bc65f14a947c64ca53137275b3a1b9bf1e1b1e01a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF15F 4892 bytes
font_01_sfnt_off000101ed.bin
73c4a892c7362055f6d5c9a94f5ce58e62370b31e36161ea3267acfcecf270f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101ED 11880 bytes
font_02_sfnt_off00012909.bin
8b3c75cdaaa72a6eb4801828774c4dd29f7ee056313c8245e3f2ed5c5f88eff6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12909 16396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.