Malicious PDF — malware analysis report

Static analysis result for SHA-256 f17677378ab93b8d…

MALICIOUS

PDF

76.5 KB Created: 2021-03-22 01:07:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1affd3834bfa2f69069de89f5d3f7bd0 SHA-1: 2b81e730c6678adec67b9e850e84ad65833131df SHA-256: f17677378ab93b8d1a48f93ec1f98154ea16e60bbaad2d26f9414a81cd2266ca
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier indicating a high probability of maliciousness. The document contains a lure related to 'tesoreria del df adeudos vehiculares' and embeds numerous external links, suggesting a link farm or phishing attempt. One of the embedded URLs, 'https://resalured.ru/wix?keyword=tesoreria+del+df+adeudos+vehiculares', is particularly suspicious and likely leads to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=tesoreria+del+df+adeudos+vehiculares
    • http://wetikufuwigiwox.iblogger.org/atp_challenger_calendar_2018.pdf
    • https://mekiwukokoviv.weebly.com/uploads/1/3/4/8/134867966/7189986.pdf
    • https://povizizumor.weebly.com/uploads/1/3/4/6/134636509/772694bb87be0.pdf
    • https://gibegijatu.weebly.com/uploads/1/3/5/4/135400332/6619349.pdf
    • https://dizusama.weebly.com/uploads/1/3/4/7/134730201/6541688.pdf
    • http://todolosepaxo.iblogger.org/how_many_calories_in_a_4_for_4_wendys.pdf
    • https://zigibopujomez.weebly.com/uploads/1/3/5/3/135350997/favapepurakutin-basivisu-ranatajolelati-bekiteganiwe.pdf
    • http://waniruraguxi.22web.org/boards_and_beyond_promo_code_2021.pdf
    • https://wanovupejofo.weebly.com/uploads/1/3/4/5/134580977/7793130.pdf
    • https://wugabatove.weebly.com/uploads/1/3/5/3/135318753/zulurubamuv-jazakixonaligat.pdf
    • https://pudabesipewoz.weebly.com/uploads/1/3/0/9/130969441/bad253f0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_f8bb8975e46247c58e840e5abb517e4a.pdf?index=true
    • http://joxumokuri.epizy.com/bluetooth_software_for_laptop.pdf
    • https://s3.amazonaws.com/kawotexulozax/20876009369.pdf
    • https://s3.amazonaws.com/tipikaxe/dagannoth_kings_guide_2019_osrs.pdf
    • https://7a579b3f-ce96-4c66-abdc-991530493d29.filesusr.com/ugd/010c6b_7d26a740e57c47a0af622eabc8280b4c.pdf?index=true
    • https://s3.amazonaws.com/dewutexorob/zijusebexumigeboner.pdf
    • https://s3.amazonaws.com/seriposuj/5091422320.pdf
    • https://s3.amazonaws.com/vexosafugunu/linalazekud.pdf
    • https://s3.amazonaws.com/kefiperizonofu/picture_editor_apkpure.pdf
    • https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_6d995dde348c4b32aae3e2fee42632f1.pdf?index=true
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_4a55bd227f4b496b900c495815187497.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e964.bin
321688e2cd66fa5f65b0fc1e8fb4b63cbbb0351a27f0e7cc47aac3e997796466		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE964 5116 bytes
font_01_sfnt_off0000facb.bin
1253cdff01c3491c2436206525ae62ae78013a1daec839db87572b613bed4c01		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFACB 12704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.