Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdea95e621535259…

MALICIOUS

PDF

76.8 KB Created: 2021-05-17 12:34:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ce597d0c874955185e4b10afd036d0bf SHA-1: bf3758c4b1250b0ce1e1f25846178c6fae369aaa SHA-256: cdea95e621535259e51b4e86dedb7c1580202005d3650300040caf2be5df5058
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a PDF link farm. One of the primary external links, 'https://zajinet.ru/strik?utm_term=letter+of+reference+for+office+administrator', is suspicious and likely leads to a phishing or malware distribution site. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-10044376-0', further indicating malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=letter+of+reference+for+office+administrator
    • http://saxobupazes.sportsontheweb.net/mokokijamotikeginug.pdf
    • http://vikiduxa.mywebcommunity.org/14284047910.pdf
    • http://ginalupajeriw.scienceontheweb.net/cursive_letters_practice_sheets.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/aceedad8-7c33-4a5f-9f7c-0e58301c6335/tarekus.pdf
    • https://uploads.strikinglycdn.com/files/375f36b0-8c04-4c23-b97f-f4ed34c56fef/white_tiger_cast_netflix.pdf
    • https://uploads.strikinglycdn.com/files/aa4f88bd-ed19-4faf-b620-9f462f72bb1b/wii_netflix_error_code_50299.pdf
    • https://uploads.strikinglycdn.com/files/c1c5053b-1481-444d-a634-16adb1194c42/15412676506.pdf
    • https://uploads.strikinglycdn.com/files/dcc7023b-3c58-400e-8f43-b5c6aa13b1da/takukagexo.pdf
    • https://uploads.strikinglycdn.com/files/afef97ad-0d73-4a0b-83f0-8d99b680f311/14288962447.pdf
    • https://0ea1ff7f-05b3-43a2-9744-178351a05ed1.filesusr.com/ugd/01f9b9_c2b62ce5921c4da4b563ee9da833e513.pdf?index=true
    • https://s3.amazonaws.com/bofake/44792031475.pdf
    • http://jonesojawu.myartsonline.com/99521914188.pdf
    • https://uploads.strikinglycdn.com/files/cb599f57-d065-482b-9cfd-b394ec09efd3/herman_miller_aeron_chair_size_b_used.pdf
    • http://laxukumelukadut.myartsonline.com/kodak_zi8_manual.pdf
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_c649986829c940e48aa3c65a305a097d.pdf?index=true
    • https://s3.amazonaws.com/benubapopikaj/zalunatinisi.pdf
    • https://uploads.strikinglycdn.com/files/55e3adb9-afdc-4dee-8d3c-7d7a597fb290/86599206310.pdf
    • https://uploads.strikinglycdn.com/files/722d55d3-7f0c-4e6c-895a-07fe647494ff/what_are_some_challenges_organizations_face.pdf
    • https://uploads.strikinglycdn.com/files/b2d418b6-f559-479e-adac-a295612f7cc0/48153611155.pdf
    • https://uploads.strikinglycdn.com/files/6abbd044-60fc-483a-a9fd-05a9cf1265c4/gopro_hero7_silver_4k_action_camera_price.pdf
    • https://uploads.strikinglycdn.com/files/bfb0aca3-e3b4-4b2a-a6d1-8e8ab234f9bb/2000_ford_ranger_frame_repair_kit.pdf
    • https://uploads.strikinglycdn.com/files/212e3bd8-d70c-47d3-85d2-563563118a74/55588228167.pdf
    • https://uploads.strikinglycdn.com/files/aa6fd8b9-d754-4759-acb5-e9771eff8ba5/how_to_trigger_point_psoas.pdf
    • https://a35aa970-3e4e-4c20-be1f-53d10001bce9.filesusr.com/ugd/af4e73_66d11ab3c9104e658031a6c77eeb08b9.pdf?index=true
    • https://s3.amazonaws.com/betefowubevat/dirt_devil_power_express_lite_parts.pdf
    • https://uploads.strikinglycdn.com/files/6f25f07f-a1ea-40b7-ae98-3e175b5aafc4/gaxomemuranupoza.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f13c.bin
8f78418667c9d4c1c69d27fce392cdade2c582c43e3d699c1c2e5d200a6ad22d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF13C 5076 bytes
font_01_sfnt_off00010271.bin
00eb3a44d0e120e2e4bcc9dbcefb104f65f18078bcc418300d4bbb59cc1c592c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10271 10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.