Malicious PDF — malware analysis report

Static analysis result for SHA-256 996c4b68a95de4ab…

MALICIOUS

PDF

85.9 KB Created: 2021-04-06 18:49:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a941d87f26a1402076aaef67ce73a2c2 SHA-1: 7b4526d24f2d4bd971167dcaaf01483979356b6d SHA-256: 996c4b68a95de4ab18940af22c3b9aec75012c8ee4c897e87cb144365b5674ec
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous external links, with one prominent URL pointing to 'xezojetit.ru', suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a '7 day mental diet', likely a lure to disguise the malicious nature of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=7+day+mental+diet+pdf
    • https://nexolibevi.weebly.com/uploads/1/3/4/4/134463206/8869047.pdf
    • https://vuvuzuvikedatun.weebly.com/uploads/1/3/4/5/134529562/2865702.pdf
    • https://falugasotemo.weebly.com/uploads/1/3/1/4/131410545/xitufexusenaba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2e6726a7-2e78-456a-9fa1-8bc85c3b20a6.filesusr.com/ugd/76e31d_6eba2dfc7587427f9d6604919a433b4b.pdf?index=true
    • http://buzeliri.rf.gd/42892018437.pdf
    • http://fuvitagenago.rf.gd/simple_messianic_passover_haggadah.pdf
    • http://likezumiw.epizy.com/original_cabbage_soup_diet_recipe.pdf
    • https://1cdd1dcb-54a5-4750-95ad-c4cce9a68cd1.filesusr.com/ugd/1e32c2_3262b5ebdd424fd7b915b4032205e453.pdf?index=true
    • https://uploads.strikinglycdn.com/files/95397aa3-e9ed-4691-ad2d-d83a25ff8a59/delonghi_trns0505m_oil_filled_radiator_review.pdf
    • https://uploads.strikinglycdn.com/files/13d4bf3f-b339-4948-b40f-9f48487ee47c/toyota_camry_hybrid_battery_repair.pdf
    • https://uploads.strikinglycdn.com/files/09eb9892-6346-49c5-8d42-72eccff55d4c/search_google_with_image.pdf
    • https://uploads.strikinglycdn.com/files/04180a53-4707-4b3e-853e-2e12f6cab72e/nordictrack_a2105_parts.pdf
    • https://s3.amazonaws.com/watajive/vamosixidewiburijaradalu.pdf
    • https://923a8ca3-316b-4844-b38f-9bc955ad4852.filesusr.com/ugd/312e0e_47c778ba8b094dc8a5201d5da18f4010.pdf?index=true
    • https://s3.amazonaws.com/mogipegi/altivar_212_programming_guide.pdf
    • http://zewedazogiwake.rf.gd/78886803748.pdf
    • https://uploads.strikinglycdn.com/files/b2425b19-d7e2-4e18-b312-434be3c883d5/66687116121.pdf
    • https://74fc1a11-d445-4ffb-bc6b-7a79e5a65a18.filesusr.com/ugd/097bd5_06c4ef088e6b430d9c9aa2843c2022b6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f8191f60-e74d-4031-8064-6bc587084e16/wilexomoxakab.pdf
    • https://s3.amazonaws.com/votuweroxigezog/xifimuki.pdf
    • https://uploads.strikinglycdn.com/files/768ad760-7414-4c19-a78b-a7049e098a87/how_to_wire_a_motion_sensor_light_without_a_switch.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010693.bin
e54a1381830a8c5102886fe84b3b2e4ee71b2658e88da450b61b5d87598ff680		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10693 4680 bytes
font_01_sfnt_off0001166a.bin
bafadd82c8c49a63b56b8f2364bc094cd68986e19ef1305ad9a1539a1cfd2fcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1166A 11096 bytes
font_02_sfnt_off00013c36.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13C36 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.