Malicious PDF — malware analysis report

Static analysis result for SHA-256 174b297299fff22a…

MALICIOUS

PDF

80.8 KB Created: 2021-03-28 21:24:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68212255178bb33f71d9ee55816f8ba9 SHA-1: 96e5acea591209f92db99fd75db7fb3ffaa7fc3b SHA-256: 174b297299fff22ab805e5a98e1c3258d42c21e83368552d0964e952ef76aa43
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a link farm, suggesting a malicious intent to direct users to potentially harmful websites. The ClamAV detection and ML classifier strongly indicate malicious content, specifically classified as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URLs point towards a phishing or SEO manipulation attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=revo+guide+2+lenses
    • https://static.s123-cdn-static.com/uploads/4464861/normal_5ff8b3eb7d41c.pdf
    • http://detonic-hypertonie.website/webadirezawetikodagon6d3p.pdf
    • http://vinograd.io/the_hobbit_2_full_movie_free_download_in_tamil7ena0.pdf
    • http://momentshop.website/snowfight._io_crazy_gamesm806h.pdf
    • https://cdn-cms.f-static.net/uploads/4454170/normal_6055bd0e94446.pdf
    • http://kungfumalibu.com/38313302146gm1zt.pdf
    • http://coloradocustomelectric.com/75224903634n9jn7.pdf
    • https://cdn-cms.f-static.net/uploads/4475995/normal_6032e6a530c12.pdf
    • https://static.s123-cdn-static.com/uploads/4386595/normal_600140ad5c170.pdf
    • https://static.s123-cdn-static.com/uploads/4410004/normal_600612d05ef57.pdf
    • https://static.s123-cdn-static.com/uploads/4465136/normal_5fde6ab0e4ab3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://63c031ef-a76e-4574-b6c7-b683c5cdde0f.filesusr.com/ugd/3a5e7a_6d02c2f95ddd4fc298e11719b4870c2f.pdf?index=true
    • https://7fe6b731-3703-45da-bcbe-faf39b4d3392.filesusr.com/ugd/880a7e_9b2def3a93874213aa8236aec7c997d7.pdf?index=true
    • https://9e2bb560-353e-4f5d-a08b-1363560edab4.filesusr.com/ugd/6c032c_5132700c41de43149135fea6a246280d.pdf?index=true
    • https://9907981b-0bc7-4fd3-a434-169f7cdadf42.filesusr.com/ugd/575363_f68beadf043c4c2fb0e66025516c1322.pdf?index=true
    • https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_9d6c2426ce33455a82b9e758c4c8b465.pdf?index=true
    • https://ff536187-e25a-4bd2-965b-ff1113cf40b0.filesusr.com/ugd/bfcccc_d1049d5b45074bc1b8b136cfb30cc745.pdf?index=true
    • https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_8516e2522a2546de8b9a04b0528dbabe.pdf?index=true
    • https://eadb47d6-6712-4ecd-aa5a-2cdcf2d90b86.filesusr.com/ugd/c844bf_75350efb26694937b6af3a2fd06a3cc3.pdf?index=true
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_471aba643c4b407eb1a1f21a5c5de48a.pdf?index=true
    • https://04a80c79-134c-446e-801b-0c1635678e59.filesusr.com/ugd/5cebf8_8390a31eda46498ab3846a8c92643486.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef3b.bin
f664dbb7e12c6ea4992499763891b3b391a01e36f47760bc8426e3dadb42dfbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3B 4688 bytes
font_01_sfnt_off0000ff45.bin
2262fb0a883657ee70363667c7196be573f7ae88420ae7b964add933db4716f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF45 11580 bytes
font_02_sfnt_off000126ca.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126CA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.