Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7c4e101e8efc886…

MALICIOUS

PDF

91.3 KB Created: 2021-03-26 11:54:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9ae09c5c2b148de6e2300700f69309f SHA-1: a8eec7d3e8fb7b8c56cae019aa0f40126f574781 SHA-256: d7c4e101e8efc8862996d29a32c272ba4a3fb16a06d13d0b29bcd0e6289dd4a2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or malware distribution attempt. The PDF contains a large number of external links, with one suspicious URL pointing to 'soxebez.ru', suggesting it's part of a link farm designed to redirect users. While no scripts were explicitly extracted, the presence of numerous external links and the 'PDF_SEO_LINK_FARM' heuristic indicate a pattern of redirecting users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=aluminium+silicate+msds+sheet
    • https://cdn.sqhk.co/dikizumi/ifihieE/48444360890.pdf
    • https://cdn.sqhk.co/lunosupi/zxnIPhj/2145791739.pdf
    • https://cdn.sqhk.co/kevekelobivo/gfZ7jaQ/71404970192.pdf
    • https://cdn.sqhk.co/jixavome/Khgig67/86482815120.pdf
    • https://cdn.sqhk.co/fuvebopeweb/eqzTieF/netukapagupofepus.pdf
    • https://cdn.sqhk.co/fudimesa/fSGVSgd/71292408796.pdf
    • https://cdn.sqhk.co/kulizuxekume/ahcjaHc/icd_10_guidelines_2019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://51956041-da35-40aa-96c1-085c1f47c80d.filesusr.com/ugd/e6e573_eeda1f61201b47bf8a61b9be086adc97.pdf?index=true
    • https://uploads.strikinglycdn.com/files/110c4f0d-7474-495d-a73c-078540b4acf9/roxinaxarawa.pdf
    • https://cb8582fb-ab29-4f13-bfd4-623ca244ab52.filesusr.com/ugd/d61b30_b26c496ac31a4e1eb0edd2fed9d690c6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e164ff05-0dcb-45c2-afe6-7fb1cd19b462/15891802929.pdf
    • https://354df738-7a8c-4643-bdcd-aa58f7c4bd0c.filesusr.com/ugd/69cf62_b83967a257e648c786c3ed3ffb2e8386.pdf?index=true
    • https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_261b6ac40193467a9fd91a91c986c947.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2cea289d-eda2-46cf-a1e7-42fcf7c7a44a/19462992338.pdf
    • http://runapapaxezupow.rf.gd/17350555677.pdf
    • http://rozibata.epizy.com/vinudeguv.pdf
    • https://ddf64d59-5240-4154-9987-17dfc28e22c7.filesusr.com/ugd/cec570_b68f3a2e73e24917b7fa969d23103654.pdf?index=true
    • http://xawatutosewo.epizy.com/1244869833.pdf
    • http://titasigor.epizy.com/7th_grade_math_practice.pdf
    • http://loxexezusus.rf.gd/spider_man_ps4_suit_trophy_guide.pdf
    • https://2ddc7431-ff91-46e9-9708-195efd6cc195.filesusr.com/ugd/ffe0d3_dead210b75cc4fef85538bda903cae7f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/01fce8a4-2821-4fbc-b202-a094336b9f66/which_book_is_best_for_anatomy.pdf
    • https://uploads.strikinglycdn.com/files/129c7988-7633-4df8-a9de-5820350c5ff1/71690071192.pdf
    • https://60b161a2-b511-46bc-b48c-7ca4331f2db3.filesusr.com/ugd/34b71b_1b8269f034a5434abc96309803267173.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012653.bin
96315d4b524102667ec2aafb2c618db185bbdbbb139bc95c25370538fdd07c72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12653 5072 bytes
font_01_sfnt_off0001376a.bin
6202b79cd72f41692b228d1d97412c03a0ea10354901c71ae24d679503b1a8aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1376A 12244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.