Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4ea632762905d87…

MALICIOUS

PDF

82.3 KB Created: 2021-03-27 20:48:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cd54545c0c4951b37715ca1e8b0ac414 SHA-1: ba468fd6a4f08afd4ad24162195f2b956fce8161 SHA-256: e4ea632762905d873749b61bb5563b6e129361926a62935b19fbd914cc58c7d9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One prominent URL, 'https://pelibifir.ru/strik?utm_term=carl+jung+16+personality+types+test', is directly associated with the document's content, suggesting a phishing or malware distribution lure. ClamAV detection and ML classification further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=carl+jung+16+personality+types+test
    • https://cdn.sqhk.co/bexikerez/b3gd2jh/chuchel_2_dantdm.pdf
    • https://zugixipenelir.weebly.com/uploads/1/3/4/5/134591811/dulobelifiwewi.pdf
    • https://cdn.sqhk.co/retakabif/uGjifha/93105414467.pdf
    • http://favanitum.iblogger.org/lexunazisukovetilevodokid.pdf
    • https://nubugudapo.weebly.com/uploads/1/3/2/8/132814946/gakute_jokevawebivan_wedafefo.pdf
    • https://wefexubi.weebly.com/uploads/1/3/2/7/132712326/biwigu.pdf
    • http://nakukudol.iblogger.org/descargar_antiheroes.pdf
    • https://cdn.sqhk.co/vemosoveveb/LT3ahfH/22347835679.pdf
    • https://cdn.sqhk.co/xefilelo/Tje3Hjf/pixavixowadewomasomi.pdf
    • https://cdn.sqhk.co/kitijorawul/4wR32hh/mewofawurovizu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/genijusemu/17866605671.pdf
    • https://uploads.strikinglycdn.com/files/d6670ed5-beb4-4c84-95e7-41391d7430f0/what_is_life_life_is_like_a_big_obstacle.pdf
    • https://uploads.strikinglycdn.com/files/22c1a059-e142-44b4-bd13-4cd81f53b7ea/baby_bjorn_carrier_one_air_vs_ergobaby_360_omni.pdf
    • https://s3.amazonaws.com/batoragubukepo/tovadivanimaromagi.pdf
    • http://witugida.rf.gd/azur_lane_formidable_loadout.pdf
    • https://uploads.strikinglycdn.com/files/a325be6f-c803-48eb-be13-d81cdc1f0ae7/64472199531.pdf
    • http://gokosipok.rf.gd/siketodonabiziwowomid.pdf
    • https://s3.amazonaws.com/radubozufiwo/xevulimowavevivumedanu.pdf
    • https://uploads.strikinglycdn.com/files/3fa6333e-149a-433e-922d-309eb518a2da/black_and_decker_edger_blade_change.pdf
    • https://uploads.strikinglycdn.com/files/3ab4b0d6-250e-4ab2-9738-563e8e1fed5d/56503658906.pdf
    • https://uploads.strikinglycdn.com/files/48f16a7a-2156-448d-b3a0-8e45b6f44226/geravefofakijuxa.pdf
    • http://jogulele.epizy.com/roboto_font_for_word.pdf
    • https://uploads.strikinglycdn.com/files/6818924b-a421-412d-b767-e00495568806/how_to_be_a_caregiver_for_someone_with_dementia.pdf
    • https://s3.amazonaws.com/kubedukowug/keltron_kannur_internship_report.pdf
    • https://uploads.strikinglycdn.com/files/baf2b76a-85c7-4748-8a9f-0904b62a5bea/breville_toaster_oven_pro_sale.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010364.bin
5cfa5e76d4fb12a8a088d109fbb6cae3c795f3ed83bc68872d2622ae45483e1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10364 5276 bytes
font_01_sfnt_off00011575.bin
826ac8d12c4a3b13a88f21eda7a75af385fd55b63584e38c2ff3528abffd16aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11575 11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.