Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1443114e55e4f94…

MALICIOUS

PDF

81.2 KB Created: 2021-04-06 13:19:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c1db541cd828a005dd074bf295185460 SHA-1: a62c9a891127922233d15cc55204ee29c4dad0d1 SHA-256: d1443114e55e4f9466adc33e0d924953245bb674a4fced0371aec0742ae6c669
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm designed to redirect users to potentially harmful websites. The primary malicious URL identified is https://xezojetit.ru/aws. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure points to a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/aws?utm_term=how+to+get+data+analysis+toolpak+in+excel+2016
    • http://myfirstsite.xyz/grammar_school_test_papers_with_answers1p9pk.pdf
    • http://fastpeysistem.online/yoga-kundalini_upanishad_download27ygj.pdf
    • http://meetporte.xyz/116769631453nbvv.pdf
    • http://pozebesibi.22web.org/merupibazet.pdf
    • http://xamezemepil.22web.org/aaradhike_song_lyrics_in_malayalam.pdf
    • http://springital.fun/cake_recipes_without_oven_malayalamw4uws.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://kaveled.epizy.com/65532184097.pdf
    • https://s3.amazonaws.com/lorerexeg/62774297896.pdf
    • https://s3.amazonaws.com/tadevewuju/year_3_english_worksheets_kssr.pdf
    • https://e222b685-7c7f-4cee-b050-218328c89257.filesusr.com/ugd/c0232f_4e9fbe3eaabb42f3849c8bb42940e2d3.pdf?index=true
    • https://488a161d-122f-4e25-b35e-34d1d0e27b34.filesusr.com/ugd/bbc910_081b2de6bfed41ecb09b00305b5e017c.pdf?index=true
    • https://s3.amazonaws.com/dinilederu/skyrim_gameplay_guide.pdf
    • https://s3.amazonaws.com/vovopafubipu/potential_barrier_and_tunneling.pdf
    • https://s3.amazonaws.com/safenalavojuwu/tracfone_moto_e6_manual.pdf
    • https://s3.amazonaws.com/mizeteb/52586724327.pdf
    • https://1094d5c0-a920-47c7-a1de-7e2d56a92d84.filesusr.com/ugd/47b1e8_f2b07880c33540c3bc7152365211c050.pdf?index=true
    • https://s3.amazonaws.com/fizufapu/holcim_indonesia_annual_report_2012.pdf
    • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_42b76e71927b485e8da71450ad121a73.pdf?index=true
    • https://05491ccc-77c7-428b-9c25-74f2c6c50d4a.filesusr.com/ugd/d51d36_0181359dba304e949cae59e5513653f8.pdf?index=true
    • https://80c8fd16-4cf8-4f9f-b52b-d6c956df8f3b.filesusr.com/ugd/1a94e8_4307e7f78cf24ad585107fb3e013732a.pdf?index=true
    • http://gozotonitiki.epizy.com/toyota_avensis_2007_repair_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000effd.bin
8e364af0d9a11e5beba27d051497a95f52ca2e68150fe59417d53fb6fba62653		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFFD 5700 bytes
font_01_sfnt_off00010399.bin
30cd86db2cb8c8f40c4bf675533c3edb5abaebcc0842f8105a0276d7d2bca3b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10399 10936 bytes
font_02_sfnt_off000128c9.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128C9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.