Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee3cdd67891bda27…

MALICIOUS

PDF

137.7 KB Created: 2021-04-21 22:30:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: af9e6286005ce7c354796cf0f0cd582f SHA-1: 332033db070fd3f2cd4f234965ecd4df950c2b3b SHA-256: ee3cdd67891bda27d622e0824065d03feffcb8baaf51f496eb457cc27d7751ce
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded links, with one prominent URL pointing to 'mezovuduw.ru', suggesting a phishing or malware distribution attempt. The document body is heavily obfuscated, but the presence of external URIs and the overall heuristic firings indicate a malicious intent to redirect the user to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=fernando+alonso+crash+indy PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4456399/normal_6058d096229cf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426085/normal_5ffb7f86e5278.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4492259/normal_5fde33dc781a1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420906/normal_603e869613385.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501042/normal_5ff2a2e133305.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480749/normal_5ffbde0dde4fa.pdfIn PDF document text
    • http://pezejij.mygamesonline.org/46944338137.pdfIn PDF document text
    • http://bugosegu.scienceontheweb.net/56745810283.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/20c6b452-08fd-4a10-a3ee-8077a924ee76/clicker_universal_keypad_reprogram.pdfIn PDF document text
    • http://zosenesewil.rf.gd/best_stock_wallpapers_app_android.pdfIn PDF document text
    • http://zepapalirexi.rf.gd/mercruiser_4.3_service_cost.pdfIn PDF document text
    • https://af431a04-9ebc-4ea4-a98d-45e4ffbfad14.filesusr.com/ugd/485053_4dd02d45aa1d4981a43537efba6f3aaf.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac6d98f8-bd5c-4d46-811d-f137fb3c6c1b/how_much_does_it_cost_to_enclose_a_metal_carport.pdfIn PDF document text
    • https://6f84c080-6bd2-4154-8ce1-0e390380bda5.filesusr.com/ugd/defdb4_c57b7b3967494af9991edc5e6258e6d2.pdf?index=trueIn PDF document text
    • http://gemewepibi.rf.gd/ringtone_for_android_latest.pdfIn PDF document text
    • https://108bb973-5399-4bf7-a70e-a18780752cac.filesusr.com/ugd/760a88_13b523eb67b44fddbc7af6b2d19203cd.pdf?index=trueIn PDF document text
    • https://8f0c9b82-9570-4081-bbb7-5e23a534ea09.filesusr.com/ugd/7008f3_9e86bb15b7b044b6af7f1995a9a95b02.pdf?index=trueIn PDF document text
    • http://faxumev.epizy.com/vuxela.pdfIn PDF document text
    • https://1347de4c-4e54-429a-b84c-372e60bc5a2b.filesusr.com/ugd/6c98bc_c326de5b027b4a1fbce240378a4f4b4f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ded1bc8-9072-44a5-adbe-05c9639f6b72/how_to_eat_low_carb_and_gluten_free.pdfIn PDF document text
    • http://bividit.rf.gd/convert_file_into_word_document_free_online.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d9b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D9B4 5084 bytes
SHA-256: bb6ff446abe50e3ffb20ce3b2b1e54d5d9d9fd9e23f90904fd1093089c2ccbae
font_01_sfnt_off0001eaff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EAFF 14736 bytes
SHA-256: b900157055b64f494e8fec8f3cc3a72651e79692074e63de8afaea01a41fcada

Open this report in the interactive analyzer, or submit your own file for analysis.