Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4516a786f033099…

MALICIOUS

PDF

81.4 KB Created: 2021-04-14 19:44:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 739352621ccc7410d165a9d620c99ba8 SHA-1: 14116223a82c2af4cae10a7812d0581e6b207bb7 SHA-256: a4516a786f033099aba79265a7f69c5db49fa86c333c05bb7c62d3d30742591b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm. One of the primary external URIs, 'https://mezovuduw.ru/strik?utm_term=poetic+way+to+describe+sunlight', is flagged as suspicious. The document body, though heavily obfuscated, appears to contain metadata related to its creation, suggesting it was generated programmatically rather than being a legitimate document. The presence of a link farm and a suspicious external URL strongly indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=poetic+way+to+describe+sunlight
    • https://jenitexul.weebly.com/uploads/1/3/4/8/134859983/dobivovemu_fodojusig.pdf
    • https://debugifepini.weebly.com/uploads/1/3/1/0/131070476/vojenisizuwirimo.pdf
    • https://femuketidoxesi.weebly.com/uploads/1/3/3/9/133997502/944e2e6f1d9a7.pdf
    • https://pigasuranebuja.weebly.com/uploads/1/3/4/4/134459694/dejibuvo-kuwafataboluf.pdf
    • https://nefupoxuwuridek.weebly.com/uploads/1/3/4/7/134747690/kilenizi.pdf
    • https://zomijozefabeten.weebly.com/uploads/1/3/4/6/134636393/4133841.pdf
    • https://jezonekapinojel.weebly.com/uploads/1/3/4/6/134619201/loviwobanufov_bevol_towisinile.pdf
    • https://fibarivinudew.weebly.com/uploads/1/3/5/3/135387866/wamamuwibu.pdf
    • https://zuxaminuxux.weebly.com/uploads/1/3/4/6/134652083/91c556299.pdf
    • https://negapopede.weebly.com/uploads/1/3/5/9/135994143/1540160.pdf
    • https://pusetuliv.weebly.com/uploads/1/3/1/6/131607438/c36fea0ca800.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e673cc53-a639-4601-a2f6-870293d002ea/46267449922.pdf
    • https://uploads.strikinglycdn.com/files/ff62ad47-b8b1-4343-bbc9-618d73dbbb65/cules_son_los_animales_que_estn_en_peligro_de_extincin_2020.pdf
    • https://ef9d90ca-5811-4a1c-810e-75bcfae60121.filesusr.com/ugd/a33af7_4f64149d1a1d4d8db6c82104cbfa8f4f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a5113e92-30b6-4bd9-b558-d435f1fe2396/who_are_the_candidates_for_prime_minister_of_canada_2019.pdf
    • https://da6a6a96-7907-4aac-bfe3-592928b14ca9.filesusr.com/ugd/39e844_fc5a4c535b624d4eab0675b165c69b0f.pdf?index=true
    • https://e942959e-95af-4115-ab05-a6e38533eaad.filesusr.com/ugd/66f7a0_dbb1023b571f4e4690135824f2034e55.pdf?index=true
    • https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_6a2f6cc8b8e8413b9136629e6b81c807.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d524b331-d8ab-4877-b696-b3bb263e317c/are_mbti_tests_accurate.pdf
    • https://uploads.strikinglycdn.com/files/72d994f0-731c-4311-9c99-87899173c339/24547677345.pdf
    • https://uploads.strikinglycdn.com/files/19d915d3-83cc-4b0a-9a46-ab7b86428c96/jipekulakalotafaku.pdf
    • https://uploads.strikinglycdn.com/files/a9858840-96d0-4cd2-8099-e3fb0a412eb6/56488732069.pdf
    • https://uploads.strikinglycdn.com/files/47793275-e23a-40ff-8ce7-b9f1f6a10d32/lusiweludamupalup.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff79.bin
89ece19b1c2f6872c475d0cb02c5f9b4d445cb9772c97780a7dd524ac79a887a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF79 5536 bytes
font_01_sfnt_off00011258.bin
83cba578cc6b7bdf85e44975dcdf577b93ba82f74260538ac35cf030a535e07d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11258 11320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.