Malicious PDF — malware analysis report

Static analysis result for SHA-256 d62350d638ef6a62…

MALICIOUS

PDF

76.1 KB Created: 2021-05-17 11:40:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 72df493acf89c26d99567ba026f518be SHA-1: 76ee9128bc5a43e05cf2cf26a268b0bef7bbe965 SHA-256: d62350d638ef6a62cdbb1a9cba66bfd1e96c99f719888c52431513c2aabfd24d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to suspicious domains, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://vilenefex.ru/strik?utm_term=the+falling+man+full+movie, which is likely used to redirect users to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=the+falling+man+full+movie
    • https://radefikifuru.weebly.com/uploads/1/3/4/7/134723330/zadosuko.pdf
    • https://jarurozo.weebly.com/uploads/1/3/5/3/135320013/jimuware_vebofos_pifogasa.pdf
    • https://tewamuwomipatus.weebly.com/uploads/1/3/0/9/130969874/9926877.pdf
    • http://myyshooop227.site/school_learning_apps1oxnh.pdf
    • https://ziwagunu.weebly.com/uploads/1/3/4/8/134883986/duvuvuwofixaji-dalirogokusi-wopulomi.pdf
    • http://dommasters.site/7646611513ju9vg.pdf
    • http://onlinetyz.xyz/63754767787jugeg.pdf
    • https://pezofonarumupub.weebly.com/uploads/1/3/5/3/135396673/a144083a7d.pdf
    • https://toxofeleziwogiz.weebly.com/uploads/1/3/1/4/131406173/6249993.pdf
    • https://foxevavudutis.weebly.com/uploads/1/3/4/3/134380199/f4bb500e9.pdf
    • https://jobawanajofuru.weebly.com/uploads/1/3/4/0/134042661/begikomilusegej_salorum_boxowoze.pdf
    • https://zugimawaxudal.weebly.com/uploads/1/3/1/4/131410952/3452258.pdf
    • http://lnstagramverifiedsbadgeforms.com/wufuzeburenepivutotabjd9g.pdf
    • http://astropsychology.website/pijosajymzap.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7b926e82-64e4-427b-85cb-a9ac273ee4a7/my_hp_laptop_battery_is_not_charging_after_80.pdf
    • https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_628692ce403d414d8de1ba636e2633ce.pdf?index=true
    • https://c064424b-11a8-4e39-a524-24a74bcd733d.filesusr.com/ugd/54e393_0ea673891bc44a1abfeeaa006c1f8f6b.pdf?index=true
    • https://13006a6e-9b3f-4191-9e3f-064114488741.filesusr.com/ugd/34464a_c0588202f1a34bc08b6b6f88917e38ac.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b0e30582-7bf9-4b76-9baa-b3f1df771c14/lusumazoxad.pdf
    • https://uploads.strikinglycdn.com/files/fc263275-3e33-4d95-af02-21bca9d2c860/fenowumasulapobeve.pdf
    • https://uploads.strikinglycdn.com/files/ec1d5ecf-7fa4-4d27-a067-da322a186283/ubuntu_free_download_32_bit_iso.pdf
    • https://uploads.strikinglycdn.com/files/0aec1321-bbd7-409d-9966-53b5a2dfeb87/does_google_maps_give_live_traffic_updates.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee64.bin
5377ae53878b776babe7e9d992fd0e10e59504851ee4e8868825469a01ebe87c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE64 4916 bytes
font_01_sfnt_off0000ff07.bin
33bec6d5067708cbab957bdf65dc8bec08ca09f6570ed42e7bdd9c1b6c3d2bf0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF07 10560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.