Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a2cdfe18f5b22d4…

MALICIOUS

PDF

82.2 KB Created: 2021-04-03 23:25:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e2446a3636a382638b4082833260430 SHA-1: 2e80dd49eadd1d758ed7d347cb17903c313af133 SHA-256: 9a2cdfe18f5b22d4861c9c0c2f31b08d49dfc7a48cfaf62aaeedc0acec97a368
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating it is likely a phishing or trojan distribution attempt. The PDF contains a large number of external links, many pointing to benign-looking documents, but at least one, 'https://zajinet.ru/strik?utm_term=what+do+you+call+a+tribal+leader', is suspicious and likely leads to a malicious payload or phishing page. The heuristic 'PDF_SEO_LINK_FARM' suggests the document is designed to create a link farm for SEO purposes, which is a common tactic for distributing malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=what+do+you+call+a+tribal+leader
    • http://sowoxapexemex.sportsontheweb.net/how_to_open_gillette_fusion_proglide_styler.pdf
    • https://viwosakizipisot.weebly.com/uploads/1/3/5/3/135321869/jifekezaniw-pivuzepuxi-padij.pdf
    • http://zesegalos.scienceontheweb.net/anatoli_boukreev_the_climb_download.pdf
    • https://likufuzojelawaf.weebly.com/uploads/1/3/5/2/135298946/wuxogu-gokizomabix-weranar-bolivunobena.pdf
    • https://ruwatija.weebly.com/uploads/1/3/4/8/134846771/188722.pdf
    • http://lezigovedavide.getenjoyment.net/windows_10_bash_python_command_not_found.pdf
    • http://vodabutopidaru.getenjoyment.net/celebrate_good_times_lyrics.pdf
    • https://mevukufidax.weebly.com/uploads/1/3/1/3/131379039/dofaliminetona_dijatezunimo.pdf
    • https://kasezikibojeg.weebly.com/uploads/1/3/1/8/131871727/vateluk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/waduzirader/mozig.pdf
    • https://s3.amazonaws.com/jovekus/nikon_coolscan_v_ed_driver.pdf
    • https://s3.amazonaws.com/zewimu/nevasovegumuxul.pdf
    • https://uploads.strikinglycdn.com/files/7775d478-d21a-42cf-bb91-c0c84e1af275/22321225616.pdf
    • https://s3.amazonaws.com/xufaxoferugod/1406600344.pdf
    • https://uploads.strikinglycdn.com/files/0ab02cbc-bda4-41d5-b201-8ed30b8daf3b/john_deere_950_cultimulcher_parts.pdf
    • https://s3.amazonaws.com/silubebebefuju/21164981744.pdf
    • https://uploads.strikinglycdn.com/files/cd63ccc7-5bc0-4e3e-b87f-b4cd816c0ac0/89321912870.pdf
    • https://uploads.strikinglycdn.com/files/198e8735-fb8e-4026-be92-2562125075c0/91074744120.pdf
    • https://uploads.strikinglycdn.com/files/401f4329-df65-4047-bf74-d3e4962518bc/is_kirito_and_asuna_still_together.pdf
    • https://uploads.strikinglycdn.com/files/ff5ee864-e56a-43af-8098-58067a973d48/psycho_robert_bloch.pdf
    • https://uploads.strikinglycdn.com/files/084c8592-3bb6-4208-8765-ffdd0d16bbdc/jipafubefesulini.pdf
    • https://uploads.strikinglycdn.com/files/5fb39fce-6b0e-4234-89ea-846563737215/57218314753.pdf
    • https://s3.amazonaws.com/dobikasukavu/zoradifogabebatewamed.pdf
    • https://uploads.strikinglycdn.com/files/109d9525-13db-45a1-8498-471de49c5d75/casio_ctk_2400_price_philippines.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104a3.bin
b2e2b788fb6267b0e4e90227632940fd7c8fad4ecc0be57e418ef30974665c66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104A3 5104 bytes
font_01_sfnt_off0001160b.bin
d47db264df61c312c8657a4054d93fedc6748f2669ed82a7a87b5431f70de416		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1160B 11656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.