Malicious PDF — malware analysis report

Static analysis result for SHA-256 e32417139911a1b6…

MALICIOUS

PDF

109.8 KB Created: 2021-03-15 02:08:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6fb9a14f29941f53540c888b383cd81b SHA-1: d95b1383d14ee0ce36479c7d6701b98fd7173fcf SHA-256: e32417139911a1b67e55bdf957769a57bd6e35f7295edddab9c794de84112fd0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which are hosted on dynamic or user-generated content platforms, suggesting a link farm or SEO manipulation tactic. The primary URL, 'https://soxebez.ru/wix?keyword=is+former+first+lady+capitalized', is likely part of this scheme. ClamAV detection as 'Pdf.Phishing.Trojan' and ML classification further support its malicious nature. No scripts were extracted, but the PDF structure itself is indicative of a malicious intent to drive traffic to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=is+former+first+lady+capitalized
    • https://cdn.sqhk.co/siripeka/mrnWKih/spongebob_frozen_face_off_hd_dailymotion.pdf
    • https://cdn.sqhk.co/xopuwomu/4zvjahb/pudamej.pdf
    • https://pakosikan.weebly.com/uploads/1/3/0/7/130740558/woxewuzolofozimel.pdf
    • https://webexozaputer.weebly.com/uploads/1/3/2/6/132681415/9564614.pdf
    • https://wefigofotagovir.weebly.com/uploads/1/3/4/8/134864379/peniwupufapig_sazejenexazepa.pdf
    • https://savibivo.weebly.com/uploads/1/3/1/3/131381036/jigelilexebaz-zuditi-zowajekefu-kaguzi.pdf
    • https://poxovoxi.weebly.com/uploads/1/3/5/3/135398301/3796329.pdf
    • https://zabamaki.weebly.com/uploads/1/3/4/8/134849969/pafeguve-lelosiwepiwinat-wasulokawero-zezovefoka.pdf
    • https://kifosaxuwaf.weebly.com/uploads/1/3/4/0/134016965/kiwadozelejimow.pdf
    • https://dukilukisa.weebly.com/uploads/1/3/1/0/131070258/tatinexoruv-kawajemipisi-dodufile-lawukireniwon.pdf
    • https://xabejopoturidu.weebly.com/uploads/1/3/4/3/134352457/348fd7cc.pdf
    • https://cdn.sqhk.co/vinusubat/eMieXib/simule.pdf
    • https://wosubazaroden.weebly.com/uploads/1/3/0/8/130813518/ragozitojowu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://s3.amazonaws.com/vonuxagupeduze/14449566298.pdf
    • https://uploads.strikinglycdn.com/files/04092bcd-c567-4ba5-93a1-5fd33df27dcc/bewulalagan.pdf
    • https://s3.amazonaws.com/litunux/16572129499.pdf
    • https://s3.amazonaws.com/teximikamukubo/crusaders_of_light_paladin_dps_guide.pdf
    • https://s3.amazonaws.com/nuxulikiwab/65351175366.pdf
    • https://uploads.strikinglycdn.com/files/a28e24c0-8b12-4b1f-a81e-99b64da0cec2/international_marketing_jobs_in_europe.pdf
    • https://uploads.strikinglycdn.com/files/61092893-34b8-43cb-abac-54b42d9ff52b/iworld_bluetooth_speaker_system_for_garage.pdf
    • https://s3.amazonaws.com/fovezewi/holt_algebra_1_workbook_answers.pdf
    • https://uploads.strikinglycdn.com/files/750d1fe0-b3ff-4823-8aa6-17fa740c84d2/52242068489.pdf
    • https://uploads.strikinglycdn.com/files/787b8a1e-b12d-4f16-9bfd-822a5413cc63/kexusadumosaninezakevamu.pdf
    • https://s3.amazonaws.com/genedonapubefe/luvaz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012fd7.bin
1982f32946bc1bf6d61e6c8777c309128834eccd73946ff6af47b6e0e0b9aed1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FD7 3860 bytes
font_01_sfnt_off00013db7.bin
b284b2f0ad15f535dae1e1ea9560f8c6629d68436266e3f59a50c8d0443094cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13DB7 5388 bytes
font_02_sfnt_off00015008.bin
508cb6f5e5afad4d4c5c6643f7476533ccadcabd5ed0ee7f91d4d01c89678f0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15008 13956 bytes
font_03_sfnt_off00017c16.bin
ba7f8d666172e01491e74504b4b54b465dc328a95d6d16067d43b661d3ed72f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17C16 19272 bytes
font_04_sfnt_off00019c0f.bin
752542f3400ffc9476ed1300b34c6365aad5b853b03d43b8e8c1dd1cf6668559		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19C0F 3088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.