Malicious PDF — malware analysis report

Static analysis result for SHA-256 c42a44604e2e5e41…

MALICIOUS

PDF

69.2 KB Created: 2021-04-03 18:41:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0785df38f2bf67c96358083a97a6024a SHA-1: 124ad9c203e7cba7dd1e26276b4cbd06233405b7 SHA-256: c42a44604e2e5e41432812bf6ec3fb06c6253e87b18db7d41e4a6d6903c94fb4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, including one to 'vilenefex.ru', disguised as an installation manual. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or phishing attempt. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. No scripts were extracted, but the presence of many external links points towards a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=honeywell+wifi+visionpro+8000+installation+manual
    • https://mamumudud.weebly.com/uploads/1/3/0/8/130814078/fabazajolekezi_rikatulip_difama_fetotejesivedeg.pdf
    • https://buvewetaki.weebly.com/uploads/1/3/0/7/130775635/gemubolotisopef.pdf
    • https://cdn.sqhk.co/veladaxuzeba/ghuzbli/pcg_capital_funding_group_llc.pdf
    • https://nitavadokeja.weebly.com/uploads/1/3/1/1/131163909/8f8d92773bf7026.pdf
    • https://cdn.sqhk.co/zifeduwa/Siehhnr/pabujomabonejaso.pdf
    • https://cdn.sqhk.co/wefadegese/hidhecD/jozuduriwudovip.pdf
    • https://cdn.sqhk.co/vedisaso/djiigB3/68818673714.pdf
    • https://kajanivok.weebly.com/uploads/1/3/2/8/132814977/xexizixejovoku-fufitupubu-zezurivemilub.pdf
    • http://debakabuxaw.22web.org/zelda_breath_of_the_wild_cemu_performance.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/561e02b6-6430-440f-bd5a-bdd3fd9155ac/what_is_the_average_speed_of_formula_1_racing_car.pdf
    • https://uploads.strikinglycdn.com/files/96b0a16d-b26e-4eac-bb1f-95e7a9042bb1/cual_es_el_tema_central_del_cuento_la_gallina_degollada.pdf
    • https://uploads.strikinglycdn.com/files/e3c7556b-9319-4ee9-a60c-badee1011653/65673721907.pdf
    • https://uploads.strikinglycdn.com/files/149bc505-479d-4672-b4e1-a1ec939c6592/6155033661.pdf
    • https://uploads.strikinglycdn.com/files/d5116df7-a9f8-4e10-a2cf-22bca80f0cee/are_phobias_and_fears_the_same_thing.pdf
    • https://uploads.strikinglycdn.com/files/b6f889ee-b3bd-45ff-9ab9-aa54357fb4f8/us_army_logo_no_background.pdf
    • https://uploads.strikinglycdn.com/files/7b04f7d1-dd75-4b50-9c17-e9d4a53f2ef7/17220645935.pdf
    • https://uploads.strikinglycdn.com/files/f9e0e73f-7746-4d8f-8806-77d2b0dc0030/71915236734.pdf
    • https://uploads.strikinglycdn.com/files/e04e2044-b3d3-4df2-ac2d-92773dfc26c3/zavewegaxagipez.pdf
    • https://uploads.strikinglycdn.com/files/103cd950-2ecb-4a10-9b1b-abaf06786f82/how_to_use_speed_queen_top_load_washer.pdf
    • http://nasukenapab.epizy.com/bomimosotixufibi.pdf
    • https://uploads.strikinglycdn.com/files/d72f0239-1515-4f00-8981-c72232f0812f/14888512617.pdf
    • https://uploads.strikinglycdn.com/files/73e36431-129a-4a83-83e5-976fed60793d/78510084351.pdf
    • https://uploads.strikinglycdn.com/files/7f6a1a72-412a-4117-9d28-4231245c8249/beats_solo_pro_comparison.pdf
    • http://nugoxasozuvazet.rf.gd/does_oxidation_occur_only_at_the_anode.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdc9.bin
82c173353eda854e7dbd2b23cd5136710d0bd9b8af5af64564e355ba083de325		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDC9 5600 bytes
font_01_sfnt_off0000e0df.bin
6095aed2aefe65f0bb49a1b27aa5d4e268c25851b4781de516c0fce8d192f74f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0DF 10620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.