Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c77e682ac2d3971…

MALICIOUS

PDF

70.1 KB Created: 2021-04-02 17:45:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e3406cd0c482cb49e88d858416d0a90 SHA-1: de0275b390a4dce3284cdce02ca6066a1f93fd70 SHA-256: 0c77e682ac2d39716a622c8851d6b12844c0572ca56d70182f726d0eb4ecd1f4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a significant number of external links, with one pointing to 'https://maypoin.ru/wix?keyword=varya+akulova+facebook', suggesting a phishing or malware distribution lure. The presence of a PDF link farm heuristic further supports the attack pattern of directing users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=varya+akulova+facebook
    • https://cdn.sqhk.co/sojuzafu/fygjEic/bake_keto_cheesecake.pdf
    • https://cdn.sqhk.co/votawusebak/iggcrii/tikupusaguzolo.pdf
    • https://cdn.sqhk.co/jofijoju/aWidh3A/download_game_robot_crash_fight_unlimited_money.pdf
    • https://cdn.sqhk.co/vefusujix/Ihbhbgc/fruit_splash_game_download_for_pc.pdf
    • https://cdn.sqhk.co/moturalogupe/88haJAY/11654967528.pdf
    • https://cdn.sqhk.co/fovuxugo/ihihYib/30314395947.pdf
    • https://cdn.sqhk.co/juvebuzizej/jcjdji0/77674859609.pdf
    • https://cdn.sqhk.co/muruwake/RMt3LYP/song_hits_magazine.pdf
    • https://cdn.sqhk.co/fijajiles/i9thaVk/talk_with_other_parents.pdf
    • http://viwavidif.getenjoyment.net/sijodelolasutiromesosu.pdf
    • https://cdn.sqhk.co/kivipemo/gciihgY/luzelak.pdf
    • https://cdn.sqhk.co/jesupasuzoku/gjheajc/rebezepabonavof.pdf
    • https://cdn.sqhk.co/zasokolof/DZF4ogd/718910972.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e6646a2c-1867-4fbc-bf8e-885d6800615f/44792138896.pdf
    • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_02eb609e98ec415b8dec8036de81e9e4.pdf?index=true
    • http://laxuzoto.onlinewebshop.net/nadururusozuwefag.pdf
    • https://uploads.strikinglycdn.com/files/74c46d4d-2700-4583-9193-c9a2ff35fc45/59843028528.pdf
    • https://2efabd41-1f95-43d0-8245-5f8eb9267247.filesusr.com/ugd/2f4ddf_0b0354469b754f27aea94e76173a6e9d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e77f1b4f-5ab6-4f4f-bc78-30d51f7e311f/71185633065.pdf
    • https://uploads.strikinglycdn.com/files/96b2641e-95af-4703-b840-cfcfb959b932/65015229739.pdf
    • https://uploads.strikinglycdn.com/files/331d0807-1c00-4942-a401-601677c9211b/xiduzex.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4d3.bin
191c2bbf4578c267945b8a1bd62f94031710d765d44a7e086c78af8d07e83595		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD4D3 5028 bytes
font_01_sfnt_off0000e61c.bin
c8d43be4d3689d19c70bf9e11d793a189b6de70761094679bd98bf623c3a79fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE61C 10312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.