Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac21dfaf9ec53420…

MALICIOUS

PDF

82.1 KB Created: 2021-05-23 01:07:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 01e4f5df1354c8a7c0a679fb94b47548 SHA-1: 9902fadce38b07f209dccf69ffe6fe6c78c5acd8 SHA-256: ac21dfaf9ec5342059ea5ad0120424b8779a54090771a79d3e2b702c67963ec8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of external links, many of which point to benign-looking documents, but one prominent URL, 'https://xezojetit.ru/strik?utm_term=excel+vba+check+if+sheet+exists+in+workbook', is associated with malicious activity. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of numerous external links suggests a link farm or redirection mechanism designed to lead users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=excel+vba+check+if+sheet+exists+in+workbook
    • https://narodejezagog.weebly.com/uploads/1/3/3/9/133988416/3925947.pdf
    • https://velebipuzufal.weebly.com/uploads/1/3/4/4/134434208/melobikosokoji.pdf
    • https://cdn-cms.f-static.net/uploads/4367951/normal_60307b305cc31.pdf
    • https://xuxedujuwa.weebly.com/uploads/1/3/5/3/135345360/55fbb3e6a.pdf
    • https://palepolute.weebly.com/uploads/1/3/5/9/135963306/xasajujene.pdf
    • https://xinefozi.weebly.com/uploads/1/3/0/7/130775465/4110702.pdf
    • https://guwawafike.weebly.com/uploads/1/3/5/3/135338161/9c9bb8bc1b3553e.pdf
    • https://tajulariti.weebly.com/uploads/1/3/4/8/134863193/wikiwonixuwejida.pdf
    • https://static.s123-cdn-static.com/uploads/4443803/normal_5fdfd03dab949.pdf
    • https://vefesipawadupo.weebly.com/uploads/1/3/4/7/134746991/0ac719.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/towakog/sportcraft_air_hockey_table_manual.pdf
    • https://uploads.strikinglycdn.com/files/04cf3465-42d5-49e1-af1a-13b34520a003/how_to_use_a_walmart_cash_register.pdf
    • https://uploads.strikinglycdn.com/files/9a020cd1-818f-4233-847e-88fa6295bc2a/english_grammar__in_use_intermediate_2019_5th-ed.pdf
    • https://s3.amazonaws.com/bokelur/online_calendar_template_2020.pdf
    • https://uploads.strikinglycdn.com/files/663410a5-7e28-4dbf-b571-84b610c312b4/etapas_de_la_fecundacin.pdf
    • https://uploads.strikinglycdn.com/files/5f6dbd5e-30e4-4355-a50a-99331c4d4af0/the_last_song_full_movie_123movies.pdf
    • https://uploads.strikinglycdn.com/files/12d6e67c-233f-49b1-a7d4-34b2e8586e01/21600269781.pdf
    • https://uploads.strikinglycdn.com/files/bc5e95e7-068a-4a23-8a23-fac395c33ec7/miller_bobcat_225g_plus_welder_generator.pdf
    • https://s3.amazonaws.com/turip/numpy_for_python_2._7_linux.pdf
    • https://s3.amazonaws.com/vitelitubovuluj/what_is_the_melian_dialogues_about_summary.pdf
    • https://uploads.strikinglycdn.com/files/d83b43b5-0e66-477b-b18c-c950bf7a1aca/gepurivivinak.pdf
    • https://uploads.strikinglycdn.com/files/886198fe-5bd2-4bcf-84a7-675e52e97695/lupidufu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec87.bin
25c95ea16f552071e77379dbf8a7a720a16f79d900295183e19952e917e3304b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC87 5352 bytes
font_01_sfnt_off0000fed5.bin
4cbeeaa8e949669c24ff23e6c9ed2adbe719ff9948050b5fbc0bf10b5c5cb504		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFED5 10548 bytes
font_02_sfnt_off00012325.bin
547aa25baa6b773f2c2680cb21b8e62307e93fd94c90190b96cdb2b9a6058a75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12325 16232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.