Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5a3ca321e427fc6…

MALICIOUS

PDF

79.8 KB Created: 2021-03-19 06:56:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d48dd14f17f1412d3974220633476f55 SHA-1: 62cdaf716920f5965021b21a10f61bc0f9c4a22a SHA-256: c5a3ca321e427fc646fecd38018d7c775149a4c024bcc9cb2a3655a30d4290ec
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are likely part of a link farm designed to improve search engine rankings for malicious content. One of the primary URLs, 'https://xezojetit.ru/wix?keyword=the+case+of+a+self+contained', is directly embedded and suggests a phishing or malware distribution attempt. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=the+case+of+a+self+contained
    • https://cdn.sqhk.co/rolileduvof/lC5vh7U/invoice_template_excel_a5.pdf
    • https://cdn.sqhk.co/dutebosatu/E7JijUH/vuxupiwuganajemabizijalab.pdf
    • https://cdn.sqhk.co/romilononove/jgzTifw/sivuneniliwufuladatogik.pdf
    • https://cdn.sqhk.co/tedigedubemi/ajfDgdM/guided_access_iphone_can_t_unlock.pdf
    • http://soldonlittleton.com/lubuxilobanaluvh0o60.pdf
    • https://cdn.sqhk.co/fuvivemu/giihhhu/greenland_movie_release_date_streaming.pdf
    • https://cdn.sqhk.co/soxuvezosapa/hhgjER0/heartgold_pokedex_bulbapedia.pdf
    • http://verifybadgesbusiness.com/rebozojonifiztriq.pdf
    • https://cdn.sqhk.co/wadalibituge/ibOQxif/pf_interest_calculation_excel_sheet.pdf
    • https://cdn.sqhk.co/lituxopevuk/pLaSgg6/falling_puzzle_rules.pdf
    • https://cdn.sqhk.co/budajawisore/hdGEJgi/47813722427.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0dc4fc43-0a48-4f77-9783-2f92552fc827/sotepijirutarazila.pdf
    • https://uploads.strikinglycdn.com/files/0c4f641a-b92b-47b8-87a6-96326eadec3b/dupavimipifitofif.pdf
    • https://3f46bf15-0a8c-4e80-b3e5-a2e3bf90e008.filesusr.com/ugd/8e6e76_2b2c1badf31e4b94a921ce8c04bac356.pdf?index=true
    • https://uploads.strikinglycdn.com/files/eb211470-6394-49f4-8b96-87ea34f745c7/aws_architecture_drawing_tools_online.pdf
    • https://f87ce62f-3d5d-4c42-bff3-2e7d00444551.filesusr.com/ugd/72ed28_f9ad28742c9d4cfb9f2a3db3059b8653.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a5ceff50-7a27-473f-a127-8a7c087acefb/how_to_install_lowrance_elite_7_hdi.pdf
    • https://uploads.strikinglycdn.com/files/87d8f2b2-686a-4aab-a9db-6e8614c70cc3/maha_ganapati_stotram_telugu_lo.pdf
    • https://uploads.strikinglycdn.com/files/bb7e686a-1e0e-44cc-b767-b29abb6853f7/dbt_for_clinicians.pdf
    • https://uploads.strikinglycdn.com/files/8153cbc8-d95b-41bd-8afb-416b21753137/fz_meter_box_price.pdf
    • https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_f77613b2938a4954a410be2a476d0fcf.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5a5.bin
c12747ab2fb253151abde572bc634d7bb0448c9fee033f826dc7793e5651d906		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5A5 4960 bytes
font_01_sfnt_off0000f67f.bin
81a9ace667adb0fe50de2bb267114bbcd9c0d5b311700f8de5b5bfc861d1a901		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF67F 11260 bytes
font_02_sfnt_off00011d01.bin
d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D01 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.