Malicious PDF — malware analysis report

Static analysis result for SHA-256 f77b27e876d1ec6c…

MALICIOUS

PDF

81.1 KB Created: 2021-03-12 00:49:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: db31f7d58721c5d7c1790725fc6539c9 SHA-1: 088b35af588ad19f96b6c03362902c05bbfe3c0f SHA-256: f77b27e876d1ec6cbe4dc420e0c6a26efc7e8b04480683ea26d5978108f230d9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating maliciousness. The document contains numerous embedded URLs, with one specifically pointing to 'mezovuduw.ru', suggesting a phishing or malware distribution attempt. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic indicates a link farm on disposable hosting, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=interview+questions+and+answers+for+receptionist+post PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4389793/normal_602da4b2c2151.pdfIn PDF document text
    • http://peluxuba.sportsontheweb.net/netgear_n300_review_extender.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501479/normal_602240f59b1c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368225/normal_60176e6b96693.pdfIn PDF document text
    • http://damita.fun/52638543935yzx23.pdfIn PDF document text
    • http://sizuxofutitarax.mypressonline.com/what_is_crude_palm_oil.pdfIn PDF document text
    • https://xuvamifete.weebly.com/uploads/1/3/0/8/130874567/28904.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462726/normal_5fe96ba208140.pdfIn PDF document text
    • http://wozekozexufoxol.scienceontheweb.net/41555790276.pdfIn PDF document text
    • https://mesitumavitolo.weebly.com/uploads/1/3/4/8/134866133/cf1ded035c4.pdfIn PDF document text
    • http://trenketo.buzz/salivavadubusexisekab2r.pdfIn PDF document text
    • http://vir-tus.com/kathy_rain_ios_walkthrough5nzcx.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_c53dcb8c793b4f7d92c6c0f9fcb1a8d9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/01e59710-1a4e-4b92-9a69-d010fb15a134/how_often_to_replace_sump_pump.pdfIn PDF document text
    • https://e0271a52-a7af-48e9-8a99-924ce320ec62.filesusr.com/ugd/be5703_7e718692512d4bc8ae13a0fa0e75a813.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/60907c61-2cbe-43fc-8b8a-17d6f8ef7ac7/brand_identity_design_meaning.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47805d70-cabc-488d-ba72-fde26b6b6306/mini_movie_maker_app_download_for_android.pdfIn PDF document text
    • https://0502d5d0-a0f5-47b8-bc1c-644c46e4e431.filesusr.com/ugd/6cabbb_8aee0a8779674ecf810f9ae15ba654f3.pdf?index=trueIn PDF document text
    • https://e85625e8-91d5-48c2-95a4-67b7b95d5b39.filesusr.com/ugd/b97a97_61d655d86f0d402886c48e864b0c9c49.pdf?index=trueIn PDF document text
    • https://e1d5fa5a-667c-4d22-bb72-2ec96b4ed0f7.filesusr.com/ugd/01f30d_62deffd1dcb24ace8393b7a5a59fffd1.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/35468528-6469-43d7-8ce1-d6155a8a6756/lopafiginuzojobexazuwu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001004d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1004D 5332 bytes
SHA-256: 31273b594783dda6abff8a9a93c08823e6dd3c91638ba4e12aee35d81a4b3d15
font_01_sfnt_off00011297.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11297 10552 bytes
SHA-256: 4b13b048f66b2d44725898a609e73dc08f8dd982a1844b01c5f0c7fed8ee82c8

Open this report in the interactive analyzer, or submit your own file for analysis.