Malicious PDF — malware analysis report

Static analysis result for SHA-256 e23989b3271b88c0…

MALICIOUS

PDF

74.7 KB Created: 2021-03-13 13:43:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a73f819ef30fe2112509eeeb17cf9954 SHA-1: 9a229a63fc5ff04ed7ad55588a2d424f84483ad8 SHA-256: e23989b3271b88c00a4f054dc9d4d00977f2a2f0f13484ce86f24875a95e00c9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to PDF files hosted on free domains, indicating a link farm or SEO poisoning attempt. One of the primary external URIs, 'https://xezojetit.ru/123?utm_term=canon+picture+style+editor', suggests a lure related to image editing software. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=canon+picture+style+editor
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jojerigexorow.epizy.com/31881798954.pdf
    • http://titeviwexesu.rf.gd/fubapuxedabodikixebobuzix.pdf
    • https://17a6c5a8-0587-4adf-8126-5b439e15a62f.filesusr.com/ugd/54bec1_9efabd1f04be486a909e9144b12c182e.pdf?index=true
    • http://xadezifu.rf.gd/ronco_showtime_rotisserie_5000_parts.pdf
    • https://s3.amazonaws.com/luramamelolem/globo_reporter_nova_york.pdf
    • https://uploads.strikinglycdn.com/files/fd447c52-b1bb-466a-8439-afd5488b88cd/33881516325.pdf
    • https://uploads.strikinglycdn.com/files/bf91c6e0-d662-4dda-997e-cf6efc0400fe/52520615999.pdf
    • https://s3.amazonaws.com/neviwove/nukiramuris.pdf
    • https://uploads.strikinglycdn.com/files/7c4eef51-8aae-4abf-b48b-174cad48767c/mcculloch_3200_chainsaw_oil_tank.pdf
    • https://058da8ce-bb30-4b8c-81eb-8903018cac65.filesusr.com/ugd/ab745b_73e2122919b84608ba53ecbc8781a88b.pdf?index=true
    • http://fenulujexita.epizy.com/5349555774.pdf
    • http://jitoritobo.epizy.com/schwinn_airdyne_pro_heart_rate_monitor.pdf
    • https://uploads.strikinglycdn.com/files/cfeb6bc9-7d4c-4291-9ee9-5015e978dd5b/zojunimi.pdf
    • https://d86ad34a-7df2-4f47-937b-a12ab5abc0fa.filesusr.com/ugd/8cbfce_d6e2fa0f81024a42a326ee6ba16d1b6d.pdf?index=true
    • https://s3.amazonaws.com/resisuna/46379317759.pdf
    • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_4ce14074957445b48abd2d3ac3c4fa8d.pdf?index=true
    • https://s3.amazonaws.com/loxopudizus/10444559396.pdf
    • https://s3.amazonaws.com/kelukakeb/diet_during_pregnancy_book.pdf
    • https://s3.amazonaws.com/lekezaru/best_would_you_rather_questions_for_youth.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e81d.bin
c196b7d81d153e539a93b87ac723eaee81f9ea65aabc30113a24ff2538eea3c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE81D 5072 bytes
font_01_sfnt_off0000f96a.bin
483a72997dc5fb61a77838b0f27b05cad6062801cbdb8c849ac1f74d938d5f05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF96A 10620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.