Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f3b1f04c07e76ce…

MALICIOUS

PDF

77.9 KB Created: 2021-03-14 02:52:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4fc0c7c7c5766e50e85cdc55cf0c4b78 SHA-1: 554d34ff95f932d34b34f213ddf9365648701dee SHA-256: 0f3b1f04c07e76ce8289cd61135e3c588b4f4e5c6ad6c4058cacbf4ffc47da8a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are part of a link farm designed to improve search engine rankings. One prominent link, 'https://kuzutuzo.ru/wix?keyword=world+of+tanks+blitz+free+gold+hack+no+survey', suggests a lure for a game hack, likely leading to a phishing or malware site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=world+of+tanks+blitz+free+gold+hack+no+survey
    • https://devigejijakefu.weebly.com/uploads/1/3/2/7/132740662/jokosut.pdf
    • http://torevifij.iblogger.org/d_i_a_s_m_full_form.pdf
    • https://cdn-cms.f-static.net/uploads/4416151/normal_5fd990b58d6ff.pdf
    • https://jetisinodab.weebly.com/uploads/1/3/5/3/135335938/75b719d6c.pdf
    • https://static.s123-cdn-static.com/uploads/4369487/normal_5feec01e48c4a.pdf
    • http://venameripuna.22web.org/autocad_2000_lt_free_download.pdf
    • https://cdn-cms.f-static.net/uploads/4365619/normal_60333df3ebf4b.pdf
    • https://cdn-cms.f-static.net/uploads/4462982/normal_600d04356fbdd.pdf
    • https://pisekubil.weebly.com/uploads/1/3/4/3/134322001/5755470.pdf
    • https://jedawakebikota.weebly.com/uploads/1/3/4/7/134715316/3fd5f20032.pdf
    • http://fatukawudel.iblogger.org/lavebuz.pdf
    • https://cdn-cms.f-static.net/uploads/4368496/normal_604b05e75a386.pdf
    • https://static.s123-cdn-static.com/uploads/4414153/normal_60049a3c0800c.pdf
    • https://cdn-cms.f-static.net/uploads/4461481/normal_6042d4e4e6d67.pdf
    • https://static.s123-cdn-static.com/uploads/4477635/normal_5fccbfee99b1b.pdf
    • https://fepaxumezo.weebly.com/uploads/1/3/4/3/134320712/josedodaso-mokanano-kizivifewu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8c1dc56a-a131-4b43-acff-3635b9115217.filesusr.com/ugd/90423f_7f729650889a432494b0ec5a146cb675.pdf?index=true
    • http://zatafefot.rf.gd/10251721919.pdf
    • https://4e4301d6-cc9a-4939-960a-6b497c1efea6.filesusr.com/ugd/d78803_eb6cc4d187394a009d876e681e8716b1.pdf?index=true
    • https://8d59741e-369e-44be-b01e-8fbcb09d2d01.filesusr.com/ugd/7cefa9_5b0b518a4036479a8a3416e049b6dbe8.pdf?index=true
    • https://064d663d-f6b2-44cf-a6ad-083da5f315e5.filesusr.com/ugd/77eba6_c9a266f4e4a7444ea4ca12305082b229.pdf?index=true
    • http://rupevisa.epizy.com/krishna_bhajan_hd_video_free.pdf
    • https://a40b6db0-1679-4e03-879f-ac5827b9aa7d.filesusr.com/ugd/dba42a_8bfd61adc49245269bea4bd9de1776bd.pdf?index=true
    • https://71a0d42b-91d5-4e94-9338-ff69ca8a624b.filesusr.com/ugd/e5d5e5_800f3fddfa0144f89eb1235e3b7a3478.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efe3.bin
aa15d9faf567b1ffcab7a272dac3d70dfb3b92ffaf2b9137159e9a59929dbafd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE3 5712 bytes
font_01_sfnt_off00010371.bin
84b9e41bc1575b8b9446dc74db9c65ed0fe263b069d8745e17ed34fa68484761		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10371 11352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.