Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ae4b2d23d2efc7b…

MALICIOUS

PDF

88.7 KB Created: 2021-04-06 18:18:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 805a4ef54c06440628407e413321f63a SHA-1: 5079feb567623aa265439a665cbfd8c39716751b SHA-256: 9ae4b2d23d2efc7b568cff1d33e9f9930707d05cbc49feea24c5ac368f75efed
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous external links, with one prominent URL pointing to a potential phishing site. The presence of a 'download button' heuristic suggests a lure to download further malicious content, likely hosted on the linked domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=cricut+imagine+instruction+manual
    • http://maska-respirator.shop/9158420142129yyo.pdf
    • https://cdn-cms.f-static.net/uploads/4390996/normal_600e4befb3f70.pdf
    • http://vizionsmc.net/vesajimogenijivesiluzakix4o0t8.pdf
    • http://1fps.ru/68550019131maoz2.pdf
    • https://cdn-cms.f-static.net/uploads/4424036/normal_604ca9346551f.pdf
    • http://kprovk.xyz/nursing_diagnosis_for_breast_cancer_surgery1ay80.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://ef2e072a-e8a2-4438-804d-cc750be2e2f6.filesusr.com/ugd/6a22cb_83ee9f569fc7405ba6be7ea35324c436.pdf?index=true
    • https://8488b7ac-84bc-45ae-88ed-26841205fc59.filesusr.com/ugd/7cda3c_6ec8c84241df4190a1ad7fed3aa89701.pdf?index=true
    • https://uploads.strikinglycdn.com/files/00acb03e-fed7-40df-91c5-bf08ff46755a/nepefoloninemo.pdf
    • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_e971a162ff1b482ab0dc52b22b927cd6.pdf?index=true
    • http://jafepotafeno.epizy.com/chiesa_di_sant_angelo_in_formis_affreschi.pdf
    • http://xutetutadipuvux.rf.gd/48264026729.pdf
    • https://e5aadbcf-511f-4ee2-989a-4410a22eeed0.filesusr.com/ugd/64930c_b3b7954ad909422d9f84d5d708f3e92f.pdf?index=true
    • https://1fc3e790-19e1-43b7-bae7-d09a953f51fe.filesusr.com/ugd/2c608b_d2beed81e0374ac39dfc5da88cae96c6.pdf?index=true
    • http://kizofenumuvuma.epizy.com/you_can_group_noncontiguous_worksheets_with_mcq.pdf
    • https://uploads.strikinglycdn.com/files/db215b5e-c129-4998-91d6-4e9116488f59/ice_breakers_gum_tropical_freeze_ingredients.pdf
    • https://uploads.strikinglycdn.com/files/194c1741-8120-45ad-aa68-2f399f4a3ca7/star_trek_enterprise_episodes.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010cb3.bin
525035042899c3888e09091c7d195da4051cc23f43dfcc39f726f584d2a3e206		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CB3 5024 bytes
font_01_sfnt_off00011da6.bin
365ee2e4affe09a9d14719d795bf16ad77eb1e7b8ad1b5d9187ea4a722504060		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DA6 11852 bytes
font_02_sfnt_off0001458c.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1458C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.