Malicious PDF — malware analysis report

Static analysis result for SHA-256 e46a6e2c0cd5e511…

MALICIOUS

PDF

82.4 KB Created: 2021-03-25 15:47:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ef88bb6460fb5d24ecf2eeca879aa5b3 SHA-1: e2249528744e4e7b19c15989821996cb10de7fa1 SHA-256: e46a6e2c0cd5e5118bc044b7aaf299c612c309629cad6820c43924954714bd40
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and ClamAV as malicious, specifically as a phishing trojan. It contains a large number of external links, many pointing to PDF files hosted on file-sharing services, suggesting a link farm or distribution mechanism. The embedded URL 'https://jumiwimov.ru/wix?keyword=adt-1+help+kit' indicates a lure to a malicious site. No scripts were extracted, but the PDF structure and numerous external links strongly suggest it is designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=adt-1+help+kit
    • https://wukarogokemek.weebly.com/uploads/1/3/0/7/130739107/4c0ce98.pdf
    • http://mexicotop3.xyz/it_essentials_chapter_8_quiz_answersryz8w.pdf
    • https://cdn.sqhk.co/wixumenez/ifuichg/67489247274.pdf
    • https://foreguguwikib.weebly.com/uploads/1/3/0/7/130775698/vibozopivalaxer.pdf
    • https://cdn.sqhk.co/wemonamo/gheeEBi/jinafeta.pdf
    • http://kernig.pro/wordpress_themes_portfolio_free_minimalysa5c.pdf
    • https://gilawidukawopux.weebly.com/uploads/1/3/2/7/132741225/3830456.pdf
    • http://movopegudokuvo.iblogger.org/fadunanolusebefewulexojav.pdf
    • http://cleaner-inn.club/game_killer_apk_for_android_9m40sf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/db11b717-40e1-4221-989c-638681f33273/did_white_rose_ever_show_you.pdf
    • https://0a3c8164-ddd9-4522-8472-457ce31ece15.filesusr.com/ugd/d32f78_3d660d42a03f482a9efaf5ce500ceb4f.pdf?index=true
    • https://3a0d5408-2ea1-4258-8d29-5d96341cad2c.filesusr.com/ugd/79cb75_cb021609e1804221b30b10cc6d31648d.pdf?index=true
    • https://7d6e376e-1ee3-4df5-88c1-8d1511d419f8.filesusr.com/ugd/7dd30d_c7e84e930eb249b1882d8a1d2a62dd32.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b9684267-9683-4bd3-8e47-408fb9898744/dowaw.pdf
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_f5dca347ddde4c8096f0a0b7820fa470.pdf?index=true
    • http://litejuwafupijo.rf.gd/how_to_add_mendeley_to_word_2013.pdf
    • http://voposopaxemef.rf.gd/zadukaduwiliparon.pdf
    • http://kaluzepo.rf.gd/articulate_storyline_3_360_the_essentials.pdf
    • https://uploads.strikinglycdn.com/files/3756e321-c190-4cd9-bc2d-60ac66de7b7d/56866209739.pdf
    • https://1b3fde16-7575-45ba-b40e-8916c64185ca.filesusr.com/ugd/8874e8_824bf04bc00e4411b1300439d2fca380.pdf?index=true
    • http://mifazafodig.rf.gd/lajupaliwuwudakidena.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f96f.bin
dece333eb649b5a9419cf431aa3ea890e41721f796c88feb1a1e917ee76e302e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF96F 4272 bytes
font_01_sfnt_off000107ff.bin
e17df3fec25d1be5c77d3099b7560fc714d4c08052f937a3f9f01c99d24e32c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107FF 11312 bytes
font_02_sfnt_off00012e85.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E85 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.