Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8d1ad4d3eb4bf8c…

MALICIOUS

PDF

77.0 KB Created: 2021-05-04 08:32:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 32d5e373f440211ab9491e56e01c3218 SHA-1: 1d27981b67a045a633fa342d3670b9e7fd48d58f SHA-256: a8d1ad4d3eb4bf8c48285cdfebdb52fa3ba9787029d7189e863462fc30930afa
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ML and ClamAV, indicating malicious content. The presence of an embedded URL pointing to 'vilenefex.ru' suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a date, but no clear textual lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=bosch+glm+35+price
    • https://static.s123-cdn-static.com/uploads/4470016/normal_5fe4832a6a11f.pdf
    • https://cdn.sqhk.co/bumegukomuza/dhgHifT/65998849515.pdf
    • https://cdn.sqhk.co/bikugipozamu/kmchcib/34691411426.pdf
    • http://jamidufabe.iblogger.org/60424831327.pdf
    • http://subbellassecret.com/how_to_create_a_velocity_time_graphpsgv9.pdf
    • https://cdn-cms.f-static.net/uploads/4477167/normal_5fda8b780353c.pdf
    • https://cdn.sqhk.co/duwokarewesu/JgiOjhp/short_film_scripts_for_sale.pdf
    • https://cdn-cms.f-static.net/uploads/4447098/normal_5fdc3cfc38bab.pdf
    • https://cdn.sqhk.co/dulidara/ic3VghG/34766490485.pdf
    • http://znohist.site/jofewemosaravolegb892l.pdf
    • https://static.s123-cdn-static.com/uploads/4382614/normal_5fed0b346c8ce.pdf
    • https://cdn-cms.f-static.net/uploads/4473035/normal_6040fe0f5cc57.pdf
    • http://kutifelafal.iblogger.org/how_to_start_a_gas_fireplace_with_a_key.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://28546a20-d0cc-4b82-bb4f-6711990cd5a3.filesusr.com/ugd/0bcf16_84007f4dd9ed402ea0f2518825159f8f.pdf?index=true
    • https://ccd4a2e6-63e2-4dcb-a02e-1ae1253dabcc.filesusr.com/ugd/059ff1_e60f53b1aa224861bde28734fdc81e17.pdf?index=true
    • http://mutigoniruri.epizy.com/zetewikixizulipamaj.pdf
    • http://kigasuwixiw.epizy.com/teori_belajar_behavioristik_menurut_para_ahli.pdf
    • http://dutagewenurodub.epizy.com/ledatup.pdf
    • https://2061f665-9309-41a6-981d-137229ee7e60.filesusr.com/ugd/eb2fe6_6e29e4a9dba44fe78307f80a20baaf0c.pdf?index=true
    • https://8488b7ac-84bc-45ae-88ed-26841205fc59.filesusr.com/ugd/7cda3c_1b8a7efaf8af4182907750ba4e148474.pdf?index=true
    • https://e4034479-4ead-418b-af8c-5be8dc72bdbe.filesusr.com/ugd/1e8759_b6ec9afb39934b2c8ba0eb814a206cba.pdf?index=true
    • http://wabeworozad.rf.gd/physical_science_textbook.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da16.bin
f41a15ea66a99825631aea01d688a7325add1cfe065211200bc948fd062ab4ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA16 5476 bytes
font_01_sfnt_off0000ec95.bin
1ea1ef6dda755639bc2983742c7d847265b5297d43174df73ef5371bfa127502		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC95 10708 bytes
font_02_sfnt_off0001114f.bin
6e3fbd491d8b71441998836ddca0d0c102716a221ea14f8143929167ad9a79b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1114F 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.