Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e7792e89970c2c4…

MALICIOUS

PDF

78.1 KB Created: 2021-03-21 23:58:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8a3fa80a22754a581b6fea97d3995e46 SHA-1: 4087b516e303fdd7a0e3eb9cc8d16cb88b549560 SHA-256: 1e7792e89970c2c4039655f0cd341f1e4a58be6f1714f5c2e6e9ffd976d229b8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains numerous external links, with one specifically pointing to 'chromesetup.exe full' on 'gimoguvi.ru', suggesting a lure to download a fake installer. The heuristic 'PDF_SEO_LINK_FARM' further indicates a large number of external links, common in phishing or spam campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=chromesetup.+exe+full
    • http://rusherx.studio/konojomozopujax89p9t.pdf
    • https://cdn-cms.f-static.net/uploads/4427080/normal_6044ca3b3971d.pdf
    • https://cdn.sqhk.co/biluvetizom/ifig8lk/unicorn_dash_2017.pdf
    • https://static.s123-cdn-static.com/uploads/4420459/normal_5feceeef7ffac.pdf
    • https://cdn-cms.f-static.net/uploads/4503050/normal_6029cfb02e870.pdf
    • https://cdn-cms.f-static.net/uploads/4443814/normal_602b72b2ca626.pdf
    • https://cdn.sqhk.co/fedelubu/vRTja6v/animal_skins_for_sale_johannesburg.pdf
    • http://bometaximom.scienceontheweb.net/71254502533.pdf
    • http://paruxezogu.mygamesonline.org/que_tus_ojos_meaning.pdf
    • https://cdn-cms.f-static.net/uploads/4393020/normal_6020c45ea9c7c.pdf
    • https://static.s123-cdn-static.com/uploads/4447097/normal_5fdce0244b2a8.pdf
    • https://cdn.sqhk.co/tifobebe/Gjhggff/creating_blog_earning_money_guides.pdf
    • http://xitabijasava.getenjoyment.net/73124350050.pdf
    • http://biomanix.best/dijevunesowivapqho12.pdf
    • https://cdn.sqhk.co/rivinodati/hgja1bF/kafudavoruvixet.pdf
    • https://static.s123-cdn-static.com/uploads/4377912/normal_5feead415b96f.pdf
    • https://cdn-cms.f-static.net/uploads/4481275/normal_60271526db080.pdf
    • https://cdn-cms.f-static.net/uploads/4383802/normal_600c5135a411e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://78ff948a-0765-49f5-a22c-0fbe0eba7848.filesusr.com/ugd/888d0b_34fb1a8204ec465d8d8c0936044e20cd.pdf?index=true
    • http://fuvarijes.atwebpages.com/16058555361.pdf
    • https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_d40113820ad945b48d608595ebf1f7b6.pdf?index=true
    • https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_5e1ce9230c924155bc9f666bc806b177.pdf?index=true
    • https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_05237f60187d4941b591ac8d85fcae2c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f328.bin
ff7f63a2cd8636c9b249173c94cbc3e5e6af3efcc1e0f125270c257dfc647fdc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF328 4936 bytes
font_01_sfnt_off000103d2.bin
52bbf5f9708919076f01752b59cf97e3b081ee5238c228ab46ff5ed0753852dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103D2 11224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.