Malicious PDF — malware analysis report

Static analysis result for SHA-256 19076340279f4725…

MALICIOUS

PDF

78.6 KB Created: 2021-04-08 10:01:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 65d20e4414d57328f1efdd8a530acc23 SHA-1: b5eacda109ca428dc972ea2efa46888cf8afa1a4 SHA-256: 19076340279f472540e848aa7bdb005787226bf8ee4cca767e1251f479037e83
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous external links, a technique often used for SEO link farming to improve search engine rankings for malicious sites. The presence of a URL pointing to an APK download and the ML classifier flagging it as malicious strongly suggest a phishing or malware distribution attempt. The ClamAV detection further confirms its malicious nature, identifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=download+the+amazing+spider+man+apk+data PDF link annotation
    • http://xuvaxujogilo.mygamesonline.org/jazuzonaxa.pdfIn PDF document text
    • https://cdn.sqhk.co/bejamisokepu/thjjggq/monkey_ropes_online.pdfIn PDF document text
    • http://gopidap.scienceontheweb.net/22008311487.pdfIn PDF document text
    • http://luwogexejel.getenjoyment.net/sejolu.pdfIn PDF document text
    • https://cdn.sqhk.co/vifejoneses/riehiih/windows_shortcut_run_cmd_command.pdfIn PDF document text
    • http://xugewozovu.22web.org/51331487322.pdfIn macro / runtime command snippet
    • http://xulodol.mygamesonline.org/zuvilolazulisogalite.pdfIn macro / runtime command snippet
    • https://cdn.sqhk.co/semiwewedazi/5jioEgj/nhl_general_manager_job_description.pdfIn macro / runtime command snippet
    • https://danevetiwa.weebly.com/uploads/1/3/4/6/134600357/6601864.pdfIn PDF document text
    • http://lebanage.iblogger.org/dizasukofe.pdfIn PDF document text
    • https://zelowomuguzak.weebly.com/uploads/1/3/1/3/131379017/2452593.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jutenojamega/56344412233.pdfIn PDF document text
    • http://sogoxutagejuno.atwebpages.com/bls_provider_manual_2020_free_aha.pdfIn PDF document text
    • https://s3.amazonaws.com/wujodibu/16867615241.pdfIn PDF document text
    • https://s3.amazonaws.com/remeranexe/zexigexezo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b01a9364-9197-4c31-95c1-14a9a314ce34/38396596388.pdfIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/41082521962.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89020de6-d115-4479-b6c2-7bdfc3ada0a9/saferafipizewewax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/302bf492-76ca-4841-a22a-a16a83fd2b4d/pelibomobarigureselawigu.pdfIn PDF document text
    • https://s3.amazonaws.com/regovadeje/board_of_directors_roles_and_responsibilities.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE23 5580 bytes
SHA-256: ae099d25bce8554ca65d648dff80eb1a69cc06aa14efa86a9360c51d24a3fdd0
font_01_sfnt_off0000f111.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF111 11376 bytes
SHA-256: a5e6e13048ac2525e82a7861437ee56de05179a93a71f69b1eb3da12c38e02c9
font_02_sfnt_off000117a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117A1 16184 bytes
SHA-256: c9bbe3841196d63b06da3677d3c2aa49bb6c40459ba02d415d6eb21065f56203

Open this report in the interactive analyzer, or submit your own file for analysis.