Malicious PDF — malware analysis report

Static analysis result for SHA-256 15d22225dc5d066e…

MALICIOUS

PDF

90.1 KB Created: 2021-03-15 01:56:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 400e81f8acfc10bdcd7bee971c765770 SHA-1: 5ee33c93ab174e7510ed9ae642a6eec976ff694f SHA-256: 15d22225dc5d066e17bd7a3d2bc41d83950a5151a35c0114b39457c3b181b984
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=are+lg+washer+pedestals+universal PDF link annotation
    • http://oneitstore.info/what_kind_of_lightbulb_goes_in_a_range_hoodmzmkm.pdfIn PDF document text
    • http://giocodigital.website/821625546326taj1.pdfIn PDF document text
    • http://wowitaly.pro/helicopter_crash_body_remainstbm3a.pdfIn PDF document text
    • http://businessoutsourcing.org/wibedilis609s6.pdfIn PDF document text
    • http://stalekost.site/john_deere_955_parts_diagramb6hvo.pdfIn PDF document text
    • http://helpverifedbadges.com/bell_peppers_in_italian_cookingikqys.pdfIn PDF document text
    • http://faceskinagainbeauty.xyz/will_game_of_thrones_books_be_completed578jt.pdfIn PDF document text
    • http://hhizmet.com/how_to_do_a_meeting_reportco91h.pdfIn PDF document text
    • http://swiss-gear.store/36481303488x2yxa.pdfIn PDF document text
    • http://autocredit.moscow/o_oleo_de_lorenzo_download_dubladoy39tr.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6c892e0d-5736-4b4a-96a3-cd490fd1fe3d.filesusr.com/ugd/1407cd_e7881a94b9314eb2a1e49d9328d44e88.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tiduro/36541459972.pdfIn PDF document text
    • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_ec44fce2314c4f63a4340ffc2dcc3f83.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juvetaso/71976545757.pdfIn PDF document text
    • https://s3.amazonaws.com/megujobemegor/62605255687.pdfIn PDF document text
    • http://xozutafutigifa.rf.gd/vebirobudemumezin.pdfIn PDF document text
    • https://s3.amazonaws.com/wivunonovef/sigezovipaw.pdfIn PDF document text
    • https://s3.amazonaws.com/midaguvimabof/before_sunrise_full_movie_in_480p.pdfIn PDF document text
    • http://vutetokare.epizy.com/24033125520.pdfIn PDF document text
    • https://s3.amazonaws.com/mojivikapeti/mukagur.pdfIn PDF document text
    • https://s3.amazonaws.com/genedesowul/65416034656.pdfIn PDF document text
    • http://vokerajud.epizy.com/96768532021.pdfIn PDF document text
    • https://86cafecd-0af7-43e6-b578-14605c742a6c.filesusr.com/ugd/c4ddd0_a43450f15b204bac8edbdfaf6335da1a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/punagilelabon/little_shop_of_horrors_musical_release_date.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011207.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11207 2912 bytes
SHA-256: b3177c8de935bf2e05ba58035bb430970af2c83108b60a2dfb12b0772094c699
font_01_sfnt_off00011c62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C62 5364 bytes
SHA-256: ddfa34f5022cf597d65901a3b6decc7a6682cc10b9c7f39cff5d7d896b37a91e
font_02_sfnt_off00012ead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EAD 12332 bytes
SHA-256: 44980719019717b2e367b278bf24f10bcb7975175842a74ae2f253dd980b9188

Open this report in the interactive analyzer, or submit your own file for analysis.