Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca34d0a53bfa4c19…

MALICIOUS

PDF

92.3 KB Created: 2021-03-08 04:47:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: fc1905c1a08dfe03d44ef1728093fe6e SHA-1: d56f201454b3a3c24683f5bf76d55a263f4145ce SHA-256: ca34d0a53bfa4c19f9cc73fed85581a8e22faa958ad4ccf410a6d67263603e26
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with at least one, 'https://xezojetit.ru/award?keyword=what+is+limitation+of+macroeconomics', appearing to be a lure for phishing or malware delivery. The document body, though heavily obfuscated, suggests a topic related to macroeconomics, which is likely a pretext to disguise the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=what+is+limitation+of+macroeconomics PDF link annotation
    • http://axacheat4.xyz/pezojufanefb0rtv.pdfIn PDF document text
    • http://zewidixoxub.iblogger.org/50704807285.pdfIn PDF document text
    • http://mynasert.online/face_recognition_door_lock_system9iama.pdfIn PDF document text
    • http://puxuxin.22web.org/converting_fractions_to_decimals_worksheet.pdfIn PDF document text
    • http://lakufakatoj.iblogger.org/mebanetebikilerekoj.pdfIn PDF document text
    • http://adminhalil.com/manga_rock_premium_apk_3.7.1lstf8.pdfIn PDF document text
    • http://xepusuxewo.iblogger.org/26005165686.pdfIn PDF document text
    • http://zdsshop.top/interior_design_software_free_trial1494k.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://golomaje.rf.gd/12510604098.pdfIn PDF document text
    • http://falisetiven.epizy.com/lugajipitab.pdfIn PDF document text
    • http://jelolit.epizy.com/present_simple_exercises_esl_library.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22fa68e2-fb8c-4061-bb52-b9ab37b194fd/zezojimozo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59e936dd-3fc2-44c4-b4e2-fa3bf8b97dc0/do_heaters_have_pilot_lights.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba55c681-d8bb-4a77-8e05-3da83c5fe0b6/how_to_think_positive_with_anxiety.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b5b3866-30ed-48fb-87de-b81449cb7722/64095313850.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0b045db-1f62-4950-b594-8d2ad45ab302/2654773524.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11fa3a66-d5e9-494d-a9d4-5837505a1216/vipudomuter.pdfIn PDF document text
    • http://bifakafuwal.rf.gd/argentometri_metode_volhard.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a716fb4-43c1-4a73-9c04-49ac0f6d05a3/camping_merit_badge_requirements_covid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7ee11d8-db57-4942-a0ae-007ba0c0917b/whats_another_word_for_violently.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ff8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12FF8 5136 bytes
SHA-256: 5d44c55267c3d2a603219d4deb45f18bdff818ceab9295afe7772f29ba6e1e55
font_01_sfnt_off00014153.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14153 10144 bytes
SHA-256: 3464ec29c578f2288cdcee976b337861ffb48410fedc147bd08657ec499c73ed

Open this report in the interactive analyzer, or submit your own file for analysis.