Malicious PDF — malware analysis report

Static analysis result for SHA-256 e30cf517ac6ea1b9…

MALICIOUS

PDF

75.9 KB Created: 2021-06-03 14:08:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 2c421933929e9460be6f283c427e4ae1 SHA-1: 39a0454f5c9e097d7d94bb3a399b1a45c5e3fd36 SHA-256: e30cf517ac6ea1b97438b1b304bb10db05902c9e359f93d1bcb56b97f4b5fbb4
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'xezojetit.ru', which is likely used to host malicious content or redirect users to a phishing site. The PDF's structure and embedded links suggest an attempt to disguise malicious intent as a helpful document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=dictionary+guide+words+worksheet+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c86491c8-a4f4-473f-8d1d-649024454ebb/selecting_text_in_ms_word_2010.pdfIn PDF document text
    • http://jejosuxiz.pbworks.com/w/file/fetch/144503763/wegamimivoximodom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7b0de70-da62-4ec5-bcb6-9719a1eb3b8f/51030861603.pdfIn PDF document text
    • http://molitutolu.pbworks.com/w/file/fetch/144554574/terraria_sky_base_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/685fc08c-c5aa-4810-8d22-29f85738710e/ca_568_instructions_2016.pdfIn PDF document text
    • http://redejok.pbworks.com/w/file/fetch/144500889/can_could_must_have_to_exercises.pdfIn PDF document text
    • http://pamotekegopa.pbworks.com/f/fnaf_4_free_download_full_version_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b32b3ce-b1b3-4518-929c-c80dd3b2d6f1/45965442156.pdfIn PDF document text
    • http://guronavageba.pbworks.com/w/file/fetch/144498435/tipos_de_diodos_y_sus_aplicaciones.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c846f9f-c19e-4b53-b04a-94219a564dba/how_to_solve_maths_problems.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/676294de-afe3-462e-853c-a6575a333732/xajejosam.pdfIn PDF document text
    • http://negaboxa.pbworks.com/w/file/fetch/144449031/pogofalomazavututebimo.pdfIn PDF document text
    • http://zajozote.pbworks.com/f/gidanunofexefa.pdfIn PDF document text
    • http://xuwuziz.pbworks.com/f/sesulazobogutenetun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33450be3-cee4-41b2-bf03-80d32d402b69/life_of_galileo.pdfIn PDF document text
    • http://lebunurivugu.pbworks.com/f/14322751238.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4315c2ca-e74f-4741-980a-5d2aca126f8c/why_is_my_water_dispenser_so_loud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff62e55f-d8a4-4208-a156-a033c17c068f/what_are_all_the_laws_in_australia.pdfIn PDF document text
    • http://funesut.pbworks.com/f/temas_de_catequesis_familiar_primera_etapa.pdfIn PDF document text
    • http://xalanupuzewo.pbworks.com/f/galexogugajagijajiludi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98ca513d-8269-4eda-93a5-7a15ded9160b/el_mundo_de_sofia_pelicula_personajes_principales.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8086c76d-f0a4-4669-b6dc-a51cf8f4f176/bakofajisifotubonofisug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/035f3b22-bf4d-4984-a169-06c57cb1b6c1/moxevav.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA4D 5644 bytes
SHA-256: f8db7bd2ebfdda565f276a73da490775f82840abdd72500e75e4cc3e52a95466
font_01_sfnt_off0000fda7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDA7 10612 bytes
SHA-256: f31eb9e2158c9d77be362aa56adb94c34c2aedf1d6bad374d7e26d64ccc9e057