Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6e4685ae68674d5…

MALICIOUS

PDF

117.3 KB Created: 2021-02-28 03:40:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 6784b8e48776cadb143481d502f0fba8 SHA-1: db19ede0d4151ccf1b59eeaad511edb405d20cac SHA-256: a6e4685ae68674d5fd6bc5dd8d64c0897bb5a51e6c7005fe33579bb4dd225e15
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to PDFs hosted on various domains, suggesting a link farm or SEO poisoning tactic. The primary URL, https://vilenefex.ru/123, is presented as a search result for a free font, indicating a lure to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=buxton+sketch+font+free+download PDF link annotation
    • https://xefolulewonud.weebly.com/uploads/1/3/1/4/131406676/b50e85318.pdfIn PDF document text
    • https://saremugofu.weebly.com/uploads/1/3/4/0/134017097/7e69a18be3.pdfIn PDF document text
    • https://xogukozatakik.weebly.com/uploads/1/3/1/4/131453421/533fd.pdfIn PDF document text
    • http://duwudivusupo.mygamesonline.org/whirlpool_front_load_washer_error_codes_e3_f8.pdfIn PDF document text
    • http://goladelexugezi.sportsontheweb.net/vermont_castings_defiant_wood_stove_model_1945.pdfIn PDF document text
    • https://rusiwenul.weebly.com/uploads/1/3/5/3/135327855/fuvexip.pdfIn PDF document text
    • https://tiruvodeg.weebly.com/uploads/1/3/4/8/134892329/zozikududepaxuwawe.pdfIn PDF document text
    • https://zevuvizaxetu.weebly.com/uploads/1/3/4/8/134887967/76eabde22dd76.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/suzujewa/25767392869.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/blank_multiplication_table_worksheet_printable.pdfIn PDF document text
    • http://telebil.rf.gd/lativupezupixud.pdfIn PDF document text
    • http://gabepan.epizy.com/how_to_get_imovie_for_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/fajonubinomeder/zepotixixovumajowo.pdfIn PDF document text
    • https://s3.amazonaws.com/wewiro/84288214750.pdfIn PDF document text
    • https://s3.amazonaws.com/genukopapovixo/bhartiya_dak_sevak_online_form.pdfIn PDF document text
    • https://s3.amazonaws.com/loneminovu/call_recorder_pro_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/najubu/elegant_themes_free_templates.pdfIn PDF document text
    • https://s3.amazonaws.com/gogunabones/bottle_feeding_guidelines_nhs.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off00019ee4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19EE4 17324 bytes
SHA-256: 3043fee0919d1e445df81a87a4aca419627d0be5e6ddc78a69b16a44b3aa1d60
font_00_sfnt_off000130f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130F8 4032 bytes
SHA-256: b542ef1d0cf58342b23e87094195c92fb3ef72b5f030548294c42bc8a90d406c
font_01_sfnt_off00013f72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F72 5216 bytes
SHA-256: 474d61f7505adfe5d7e49d15a58213925b1b65981264d92e0202e5b5ac434f04
font_02_sfnt_off0001513c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1513C 3048 bytes
SHA-256: 1b68eb0745f369bd9f805b89718582bd6ebaf917deeaaae5095027b3f32dc7b8
font_03_sfnt_off00015d40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15D40 6148 bytes
SHA-256: be38186c9256ba0e64b07d34cca2e63b176d3ffd182ae4667a642b503e748fe0
font_04_sfnt_off00016d20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16D20 17188 bytes
SHA-256: 9c3f653566bca6bee3ef95927c2785e9f50a81a5c86d6437aa5a7032f9c097ed
font_06_sfnt_off0001b85c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B85C 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3