Malicious PDF — malware analysis report

Static analysis result for SHA-256 e18453c0f9592646…

MALICIOUS

PDF

91.9 KB Created: 2021-03-12 12:20:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 337b09abc79e9a8f17832a9751c07978 SHA-1: a68816558d68b0704bc7b97658c8964e9a3dee6e SHA-256: e18453c0f959264612ffe8b7740a045fcd1e0688fd49e36c58e06289c77219c9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, with a primary one pointing to 'mezovuduw.ru', suggesting a phishing or scam campaign. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' further supports this by indicating the PDF is part of a link farm on disposable hosting, likely to obscure the true destination or spread malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=budin+de+pan+peruano PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4487622/normal_604a2ab565ab9.pdfIn PDF document text
    • http://nekretnine.site/33275886000ih1wz.pdfIn PDF document text
    • http://zajiledafalam.getenjoyment.net/song_of_solomon_chapter_10_litcharts.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415544/normal_604a272d94710.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384639/normal_602930d1d1406.pdfIn PDF document text
    • http://italysummer.fun/11321125979jlap1.pdfIn PDF document text
    • http://kafojiv.iblogger.org/editorial_design_portfolio.pdfIn PDF document text
    • http://price-list.moscow/kewawowopitinivegez5l50j.pdfIn PDF document text
    • http://bavunexebiri.iblogger.org/tojifu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447267/normal_602089a4a7342.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416299/normal_601f0bcde05d6.pdfIn PDF document text
    • http://kifopelidito.mypressonline.com/hp_elitebook_8560w_mobile_workstation_user_manual.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405674/normal_603c04918742b.pdfIn PDF document text
    • http://jizerigozigalav.getenjoyment.net/blues_scale_chords.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372360/normal_60077212ab836.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453537/normal_5fede5461f63c.pdfIn PDF document text
    • http://gesoxusem.iblogger.org/cost_audit_report_sample.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447101/normal_603843242fe69.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xakurukedafa.epizy.com/how_to_execute_sql_file_in_sql_plus.pdfIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/krishna_bhajan_full_hd_video_free.pdfIn PDF document text
    • https://s3.amazonaws.com/megulu/28931424447.pdfIn PDF document text
    • https://s3.amazonaws.com/fadupazageraf/epigenetics_and_cancer.pdfIn PDF document text
    • http://rorolavosi.rf.gd/duxomomudepumukofofunanu.pdfIn PDF document text
    • http://nimanexobubibub.onlinewebshop.net/movutuwopewapudovi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f70e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF70E 6744 bytes
SHA-256: ffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425
font_01_sfnt_off000107f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F6 4792 bytes
SHA-256: 993c4ae10a9fb106ad8a9cbaeafb2aec2a71398a09cb30f83772bd91804b5238
font_02_sfnt_off00011849.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11849 3752 bytes
SHA-256: 7d04b217f92a67f739dce062bd110f1086761773fed84c068fc88421ac77bb08
font_03_sfnt_off00012711.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12711 10232 bytes
SHA-256: 62f59dd68db69137a85d99f97764c8fe264dd755283298002ae63723275750ad
font_04_sfnt_off00014a51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A51 16488 bytes
SHA-256: 62983dd010b7aa238131a5b5fc9b5234e97605aad009cac054b686215e957981

Open this report in the interactive analyzer, or submit your own file for analysis.