Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4939ce84a2834eb…

MALICIOUS

PDF

79.8 KB Created: 2021-03-21 03:34:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7924bb526b11cc0482b765d3605cf7a3 SHA-1: 75071d9aec1f1167a8c248e4e00a8a62ace74d2e SHA-256: d4939ce84a2834eb305adb393432646c0d3a48f2c680c099d8826c9d8b8a8f52
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a primary URL pointing to a suspicious domain ('pelibifir.ru') that is likely part of a phishing or malware distribution scheme. ClamAV and ML classifiers strongly indicate malicious content, specifically a phishing trojan. The document body, though partially corrupted, suggests a lure related to accounting systems, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=difference+between+manual+and+computerized+accounting+system+pdf
    • http://natur-bio.space/regional_geography_of_canada_7th_editionr0g7t.pdf
    • http://select-get.top/temporal_and_spatial_data_miningytmng.pdf
    • http://salearea.pro/mlm_binary_system_software_freel67uw.pdf
    • https://cdn.sqhk.co/wesusogewu/gjaKo9M/adjectives_degrees_of_comparison.pdf
    • https://cdn.sqhk.co/wikaraxixi/iNjjKhe/mekanisme_kerja_obat_antasida.pdf
    • http://trening-ekaterinodar.ru/biochemistry_concepts_and_connections_free7emqf.pdf
    • http://hurleyshamburgers.com/percy_jackson_and_the_titans_curse_chapter_14k4mnn.pdf
    • http://o-karte-kopilka.com/best_self_help_books_2020_uk0q9z6.pdf
    • http://com-connexion.xyz/84928870504sgefc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://85d2c5a2-fc31-4f76-86b4-4ebe2abe2bf4.filesusr.com/ugd/a8cc01_e2dbe3a810454362a86f6ea71fd9695e.pdf?index=true
    • https://s3.amazonaws.com/kubafezin/no_cable_tv_guide_phoenix.pdf
    • https://uploads.strikinglycdn.com/files/e9815b5f-517f-4d0a-9302-a6c1e52fd4cc/where_can_i_buy_relion_prime_test_strips.pdf
    • https://uploads.strikinglycdn.com/files/1be52a5b-8145-4602-9527-8d55a6db824f/how_to_make_a_quiz_more_fun.pdf
    • https://uploads.strikinglycdn.com/files/186bbb91-cd83-4d0e-9136-b0a719b68160/34453912162.pdf
    • https://s3.amazonaws.com/baxunaf/3650492316.pdf
    • https://uploads.strikinglycdn.com/files/a7f30da4-8a27-4c25-91b3-a832432f1909/navazesikisapalamejukugos.pdf
    • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_1f9cbac5a34b46f8a2d240af764f79c0.pdf?index=true
    • https://s3.amazonaws.com/pokixovuxik/5747566071.pdf
    • https://uploads.strikinglycdn.com/files/ecd84df8-29b4-4d11-91cd-9a37e190d69d/how_to_program_intermatic_timer_st01k.pdf
    • https://s3.amazonaws.com/tikoweravisixu/zifokaxapir.pdf
    • https://d45380bd-a93d-4ef2-b2bd-4c7806d1f6db.filesusr.com/ugd/5d2cf3_de7b2c3bb51843608c39d13a58b7e3b6.pdf?index=true
    • https://s3.amazonaws.com/fedufiporara/calendar_template_2018_malaysia_public_holiday.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f934.bin
eb918d306c85b44142d54284844768553ae17b558372c9050a365b22f71f55d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF934 5860 bytes
font_01_sfnt_off00010d30.bin
0f0831bac44ae62b84de39cc9bc230f54ce879a020295810be917bbc34237f96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D30 10660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.