Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c6f59c91c351c5b…

MALICIOUS

PDF

81.1 KB Created: 2021-05-27 09:12:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 271d2f98170354de494dd2f3465a1a2d SHA-1: 288d3b98a12076234e48c60e0c0bf17175a046dd SHA-256: 1c6f59c91c351c5bb7b93c7cda0ad9df03c35723e98fe236d21dbcafa2ac742a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one prominent URL advertising a "free script executor" for Roblox, suggesting a lure for potentially malicious downloads. ClamAV and ML heuristics also flagged this PDF as malicious, specifically as a phishing trojan. The presence of embedded links and the nature of the advertised content strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=free+script+executor+roblox+2020+no+virus PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4493266/normal_601702c89e31c.pdfIn PDF document text
    • https://gedorizifoxe.weebly.com/uploads/1/3/1/6/131607240/rarifuguxet-vuveli.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488581/normal_60421f06adc25.pdfIn PDF document text
    • https://fuxarudoniw.weebly.com/uploads/1/3/5/3/135350341/mesofuwar-zatejutetalox-vazukenapeb-sisokumoze.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387571/normal_60284059430b6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448124/normal_60331c3002556.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414515/normal_60493498f0456.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477878/normal_602fe8103e78f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393521/normal_60364ee5dfe53.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411246/normal_605db33ae7b5a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457843/normal_604b15df87d55.pdfIn PDF document text
    • https://vixoketos.weebly.com/uploads/1/3/1/4/131453026/2b662d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410020/normal_5fd63b1a3026d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449973/normal_60241ff3b475d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f930fee6-04a2-4c16-8653-031a1548d78e/what_is_esoteric_mean_in_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28616819-e3b1-40fd-a6fa-abd8a5a9b0ea/23553121877.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bde9399-53f1-4827-ab26-792429fb3d7e/craftsman_dls_3500_carburetor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0cdc761c-6d4b-44b0-94a9-de3bd44f4bb2/what_is_a_financial_performance_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91e702bd-1e01-482b-b2c1-521bb69ba3b9/rujonakuxivegamikaxix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64168647-82bd-47fa-a5be-1cd7bf549322/how_to_check_list_of_files_in_command_prompt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ebd004a-1833-4fd7-aa5e-22356bcba63b/are_beats_pro_better_than_studio.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ceabcda5-0b7d-423e-b195-fb302f19882b/best_computer_science_engineering_colleges_in_canada.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD6B 5216 bytes
SHA-256: 69873b7b2c33e8f8bc9e5c1f577cc1f4cb1de78357016e20e70cba6be36e7b59
font_01_sfnt_off0000ef3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3D 2916 bytes
SHA-256: 1e249368d708c58cae3c8c45f322bf9ffa5898ba517b37131c004401a82912ef
font_02_sfnt_off0000fbaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBAF 10876 bytes
SHA-256: 33467a5c2fabcfb5f0f961de746c939b8f1830461d1cfee79025217af02de9f9
font_03_sfnt_off00012117.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12117 16068 bytes
SHA-256: b1615e29a4fe6c7320d553a30418b4fece26933a192be804fa4a6c1955e67a67