Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb85d477ea994ae9…

MALICIOUS

PDF

69.6 KB Created: 2021-04-06 00:43:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 70e92efb0ffa4bcc7a68678162b40ac2 SHA-1: 7a99ce33285ce43acd6f588ac8570e264870f2ac SHA-256: cb85d477ea994ae92a4a7dae4e11222b580d0392a3844da8facdcc5dd05608d7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. One of the primary external URIs points to 'https://xezojetit.ru/award?keyword=livro+andreas+moritz+pdf', which is likely part of the lure. While no scripts were explicitly extracted, the presence of PDF_URI and PDF_SEO_LINK_FARM heuristics, along with the ClamAV detection, strongly indicates malicious intent, possibly related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=livro+andreas+moritz+pdf
    • https://wosuletoxo.weebly.com/uploads/1/3/0/7/130739711/lagivas-gugotusapalu-dopewubafarud-babupivulu.pdf
    • https://ruvezidarumova.weebly.com/uploads/1/3/1/3/131380493/acb83ac21.pdf
    • https://xoburorabusu.weebly.com/uploads/1/3/0/7/130738623/3903673.pdf
    • https://jowovodepavilim.weebly.com/uploads/1/3/4/6/134651336/fireluduwe.pdf
    • https://fanizoliboligom.weebly.com/uploads/1/3/1/0/131070566/razibed-vodubekil.pdf
    • http://zolijava.iblogger.org/how_to_ignore_guys.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bobujosu.epizy.com/shawn_mendes_treat_you_better_video.pdf
    • https://s3.amazonaws.com/xixonu/u_verse_remote_volume_not_working.pdf
    • https://be9c8297-50e9-4ec8-be22-7cc4068ef96a.filesusr.com/ugd/fc3b0b_ea289d15d4dd4c5bb7487ace9a55f3fd.pdf?index=true
    • https://s3.amazonaws.com/runuzitexokol/vowaxovodone.pdf
    • http://tapanowi.epizy.com/sacred_cacti_and_some_selected_succulents.pdf
    • https://s3.amazonaws.com/kovozenamofox/area_of_polygons_and_circles_worksheet_answers.pdf
    • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_f3593f24ebf44eb485c78aab1de8c8c9.pdf?index=true
    • https://s3.amazonaws.com/midaguvimabof/99040493418.pdf
    • https://s3.amazonaws.com/lekelepowo/hepatocellular_carcinoma_treatment_guidelines_esmo.pdf
    • https://f6e2a16f-d004-42cd-8f17-0463e090774c.filesusr.com/ugd/c70c35_931c675cbac64bf6b1d746b6e6f1689e.pdf?index=true
    • https://9334512a-4df1-45dc-8804-f0fa1d9e2a3d.filesusr.com/ugd/9466eb_daf98d4ff6584f658a6b81b4f0763b37.pdf?index=true
    • https://1f2f8e77-98df-4c5e-b88a-83bc2b612b58.filesusr.com/ugd/5c7528_9b8ae2f96b8e4905b0c0ff7f913f68d4.pdf?index=true
    • https://s3.amazonaws.com/fizup/lurexulodavoderilav.pdf
    • https://1864c106-1a4f-4194-99fb-dabd5a0af450.filesusr.com/ugd/17b194_4001c3c2678749478270d78b5f40c74e.pdf?index=true
    • https://s3.amazonaws.com/wanasuvedigo/vamenadupigaw.pdf
    • https://s3.amazonaws.com/befafuni/solidworks_2014_tutorial_book.pdf
    • https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_140dcc333dca4c1bb19fa2dcda07cb7a.pdf?index=true
    • https://s3.amazonaws.com/tudawufed/soruxi.pdf
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_11d44e7fb6e64085bbd00472b53f8298.pdf?index=true
    • https://s3.amazonaws.com/jugobimuraje/lunidosofu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d071.bin
9b8970759d891871065ec11dfd6c7f23a43d3acc3510877ed41c053e1e0951d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD071 5204 bytes
font_01_sfnt_off0000e227.bin
9181bb976ee1c74e6cb6cc5d94570dbe0262990f53c4966ba719c62c6a1ae076		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE227 11848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.