Malicious PDF — malware analysis report

Static analysis result for SHA-256 aac81ca71f2cd70d…

MALICIOUS

PDF

86.6 KB Created: 2021-04-02 02:26:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 207e59e1c8a77e5d2d6e3fc8f3b74b4f SHA-1: 7e31b23c2974ff0b4c873f7c3dd818aa530b8b35 SHA-256: aac81ca71f2cd70d7174a1e0e71c4170c08c584c67d2b85208ae942a192112b4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a 'PDF_SEO_LINK_FARM' suggesting a large number of outbound links intended to manipulate search engine results or direct users to malicious sites. The primary external URL, 'https://xezojetit.ru/award?keyword=barzanji+lengkap+pdf', is suspicious and likely leads to a phishing or malware distribution page. ClamAV detection and ML classification further support the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=barzanji+lengkap+pdf
    • https://domilejoxu.weebly.com/uploads/1/3/4/5/134529458/mimax-girukozagosomu.pdf
    • https://namovisurov.weebly.com/uploads/1/3/5/3/135338224/588600ce.pdf
    • https://fukekagike.weebly.com/uploads/1/3/4/5/134587407/zijivozakotomado.pdf
    • https://cdn.sqhk.co/tifisizeliz/dw7jihi/zibofetuta.pdf
    • https://joposiga.weebly.com/uploads/1/3/5/3/135399072/zugolikijefezalit.pdf
    • http://fuvafutiku.22web.org/balajefi.pdf
    • http://xevoxisukima.22web.org/7287468959.pdf
    • https://cdn.sqhk.co/xekawiba/6Ggfif5/4370724833.pdf
    • https://koropiliful.weebly.com/uploads/1/3/0/7/130740252/gitugu_kegiserefov_davagixafiw_sufojinovujadi.pdf
    • https://cdn.sqhk.co/zivuronufepu/ZjjKjcB/archery_battle_3d_mod_apk_2020.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/zagubip/79291195663.pdf
    • https://s3.amazonaws.com/jamuluvuvava/46192601522.pdf
    • https://uploads.strikinglycdn.com/files/f034abc5-2396-4389-8248-b2d1c3abf7c0/list_of_reinforcement_machine_learning_algorithms.pdf
    • https://s3.amazonaws.com/timeziso/case_study_method_in_qualitative_research.pdf
    • https://s3.amazonaws.com/vizegemawokaxe/jadikozame.pdf
    • https://s3.amazonaws.com/nonabafat/53076102059.pdf
    • https://s3.amazonaws.com/mutirexa/92818165150.pdf
    • http://berofoxuwize.epizy.com/42706673571.pdf
    • https://uploads.strikinglycdn.com/files/d9025877-b1d2-4eb4-bc25-1614beaa7df7/what_are_the_main_five_languages_of_love_by_gary_chapman.pdf
    • https://s3.amazonaws.com/woberiz/59427683848.pdf
    • https://uploads.strikinglycdn.com/files/f2dd03ba-bd4c-440a-92e7-8798b74e7f3c/sulor.pdf
    • https://s3.amazonaws.com/donake/basic_english_grammar_textbook.pdf
    • http://rajokawaxes.rf.gd/japan_guide_hakone.pdf
    • https://uploads.strikinglycdn.com/files/44904f70-5313-4ff5-a889-ff26ac4b0c39/30970661611.pdf
    • http://rajiwewovipu.epizy.com/digital_vernier_caliper_least_count.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001156c.bin
da394f6984f9eac01720ab9893a4d389ffdefb62ce9366c0ab7df1d8e9f461da		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1156C 23064 bytes
font_00_sfnt_off0000de16.bin
cae96180b9f2172d5a2e8288ce3173a5ad46f073212a64e6c5b0401c14082f9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE16 4868 bytes
font_01_sfnt_off0000eeae.bin
138a70a30dc5f12515d024f017957d4f1f9ba158c2dfd93a90e411b8507f4cae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEAE 12036 bytes
font_03_sfnt_off00013eaf.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EAF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.