Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb6e20019158c4a4…

MALICIOUS

PDF

67.6 KB Created: 2021-04-13 18:01:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 412496d420f8317a0b9df5573b8e2a50 SHA-1: 3cbdcdbc529faa5904b664d7298406ddb2d111a2 SHA-256: eb6e20019158c4a4021789981ef9a6aeecda24405e60a03617bd949072cdc856
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs, with one specifically identified as a link farm on disposable hosting. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of a URL pointing to 'mezovuduw.ru/strik' suggests a phishing or malware distribution attempt, disguised as a search result for a product.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8351

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=ps+vita+memory+card+adapter+where+to+buy
    • https://gumakini.weebly.com/uploads/1/3/1/4/131414358/zolemedetero-xijofubutakuban-vulos-raboxuku.pdf
    • https://cdn.sqhk.co/xibetevoxaj/bIihM50/fesuse.pdf
    • https://noxurawikatiner.weebly.com/uploads/1/3/1/1/131163986/7450786.pdf
    • https://cdn-cms.f-static.net/uploads/4370055/normal_6049ad32698da.pdf
    • https://cdn.sqhk.co/mumoragato/fjhnJge/phoenix_wright_ace_attorney_walkthrough_case_1.pdf
    • https://cdn.sqhk.co/fukonovum/gQaUiey/battle_souls_mod_apk_unlimited_money.pdf
    • https://bitojobuf.weebly.com/uploads/1/3/4/8/134892495/3762299.pdf
    • https://static.s123-cdn-static.com/uploads/4489057/normal_5fc87b87be16c.pdf
    • http://wopazav.22web.org/dugakosowe.pdf
    • https://tuwagufo.weebly.com/uploads/1/3/3/9/133999840/zijodexip.pdf
    • https://cdn.sqhk.co/fudikuzi/UA4iejb/44750052189.pdf
    • https://cdn-cms.f-static.net/uploads/4370744/normal_6022c6afe3d85.pdf
    • https://static.s123-cdn-static.com/uploads/4497369/normal_5ff92d4f122cf.pdf
    • https://cdn.sqhk.co/fujotojaxob/higZ2nv/real_city_car_driver_mod_apk_android_1.pdf
    • https://s3.amazonaws.com/makumapikeze/17602308219.pdf
    • http://dorofudi.epizy.com/synonyms_word_list.pdf
    • https://s3.amazonaws.com/farowug/polycom_hdx_7000_admin_guide.pdf
    • http://zowisoburime.rf.gd/30794795345.pdf
    • http://tekubone.epizy.com/modern_physics_resnick_halliday.pdf
    • https://s3.amazonaws.com/zoxewudunigus/bukajidizoximevigaj.pdf
    • https://s3.amazonaws.com/gupojakami/33271888478.pdf
    • http://foxugej.rf.gd/44150178866.pdf
    • http://mipufaz.epizy.com/tezofuwerututala.pdf
    • http://mubozezubudiz.rf.gd/diagnostico_ambiental_definicion.pdf
    • https://s3.amazonaws.com/fotojipifuzitul/resumen_de_la_obra_el_alquimista_por_partes.pdf
    • http://mowumaja.epizy.com/latest_responsive_website_templates_psd_free.pdf
    • http://tuxowisinaxug.rf.gd/examples_of_inferential_questions.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcf6.bin
00c0a141202c10936ceac8b8df9df75720096dbedde9c5fde8d9f3447cbb363c
pdf-font-stream PDF embedded font (sfnt) at offset 0xFCF6 2960 bytes