Malicious PDF — malware analysis report

Static analysis result for SHA-256 06e11ed800c271f3…

MALICIOUS

PDF

83.9 KB Created: 2021-04-30 22:54:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b9cf9898b1132c9573c4427b06c9b617 SHA-1: 66ef19ca9c992115b8cc1f9048172c579c5ebda7 SHA-256: 06e11ed800c271f3d76531e50c40b4f18b6fbeba06f4dca8d7c88f9724c69c08
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, a common tactic for SEO poisoning or phishing. The primary URL, jottigo.ru, is suspicious and likely leads to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high probability of it being a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=how.to+do+3+km.radius+circle+on+google.maps
    • https://static.s123-cdn-static.com/uploads/4375702/normal_5fe17a38510eb.pdf
    • https://toroborelap.weebly.com/uploads/1/3/4/8/134867907/11f749c3e4.pdf
    • https://tawusizigegik.weebly.com/uploads/1/3/3/9/133997505/zufimitabuxavarego.pdf
    • https://vobelorigod.weebly.com/uploads/1/3/4/0/134096073/a51f8af.pdf
    • https://static.s123-cdn-static.com/uploads/4417314/normal_5ff84ebd01596.pdf
    • https://tadesurirow.weebly.com/uploads/1/3/2/7/132711952/kefelanaditef_sijiporedufelu.pdf
    • https://wavurujubatebar.weebly.com/uploads/1/3/2/6/132682053/583e8b2f6.pdf
    • https://cdn-cms.f-static.net/uploads/4481059/normal_603068d8057d5.pdf
    • https://cdn-cms.f-static.net/uploads/4459478/normal_60362e9808ba0.pdf
    • https://static.s123-cdn-static.com/uploads/4452385/normal_5ff711a754bd2.pdf
    • https://static.s123-cdn-static.com/uploads/4421468/normal_5fccd35679479.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/7cce06c4-9395-4066-a32c-3f0abd2b5b62/buveroxidazakevozonijola.pdf
    • https://37e79482-e567-4eff-b449-6ea9b90d4679.filesusr.com/ugd/cff0cd_a28003a4a4034a4a831fddad3e1bf2ea.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5362d331-cc2c-4712-8a99-795df11a05f2/how_to_paint_by_numbers_for_adults.pdf
    • https://uploads.strikinglycdn.com/files/2577244a-34c7-48c8-ab40-669487d65cf7/talk_to_me_in_korean_free_shipping.pdf
    • https://uploads.strikinglycdn.com/files/8f120021-e162-45c0-bc38-373511e5cf43/java_8_stream_foreach.pdf
    • https://83d12552-0bc1-4415-b221-1da25caacb9b.filesusr.com/ugd/1e11d0_7c8eef21f63149bdbc5ec8f57a63770c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/706dc38d-1af2-4a8b-8d08-add8632bd4b0/zejade.pdf
    • https://bf130ee1-1463-4c69-9604-1b23772ced92.filesusr.com/ugd/b4609a_3a6d39dd62474ac787bdbbbc75c05a04.pdf?index=true
    • https://44034db3-6cdd-4729-adf3-7ccd6afcf354.filesusr.com/ugd/9fe9cc_99c9f9a324554f5dbcd24073a7dcfd94.pdf?index=true
    • https://uploads.strikinglycdn.com/files/92600a9c-27ec-49a9-b697-0cc222e797c4/ti_84_plus_ce_ap_calculus_program.pdf
    • https://uploads.strikinglycdn.com/files/3d503a68-fbfd-4092-9610-dc5c1461ecc6/ipad_mini_2nd_generation_keyboard_case.pdf
    • https://uploads.strikinglycdn.com/files/be8b8ab9-9c0e-473a-aff5-d8f9bf16de85/how_do_you_fix_a_dvd_that_wont_play.pdf
    • https://uploads.strikinglycdn.com/files/1544f3be-3cb5-43f0-8409-6d21387c910f/a_practical_guide_for_policy_analysis_6th_edition_free.pdf
    • https://uploads.strikinglycdn.com/files/200af1cb-f0fd-473d-9811-ed19ee649972/33955560589.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbfa.bin
ef13763c791dfd4098d761a1c80401614ef21ca8d60a8c1d6cf9e04ebdaabd2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBFA 5588 bytes
font_01_sfnt_off00010ef5.bin
4e4f2d1c1518f58a458689c1d8ea3348ce5934152a442273d4e45fcf932d08e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EF5 10544 bytes
font_02_sfnt_off00013321.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13321 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.