Malicious PDF — malware analysis report

Static analysis result for SHA-256 2162c438b9689f23…

MALICIOUS

PDF

103.7 KB Created: 2021-04-01 14:21:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7014e55d71e04c39da8b30c35d13c146 SHA-1: 6441a338fe00f977821ca08ff4aafd8fcea0dfd8 SHA-256: 2162c438b9689f2318ef9f5f50b70b2e23c9e50752ad11c0752cd8d5eec8b116
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a PDF link farm. One prominent external URI points to 'https://lozipotod.ru/aws', which is likely a malicious domain used for phishing or malware distribution. The presence of a large number of links, including one to 'https://s3.amazonaws.com/toguvaju/90397530579.pdf', suggests an attempt to obscure the true malicious destination or to create a deceptive link farm. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/aws?utm_term=what+is+the+poem+casey+at+the+bat+about
    • https://static.s123-cdn-static.com/uploads/4490534/normal_5fe5b04c8d179.pdf
    • https://cdn-cms.f-static.net/uploads/4403119/normal_5fd67102b34f5.pdf
    • https://cdn-cms.f-static.net/uploads/4485572/normal_602939c70bbd2.pdf
    • https://cdn-cms.f-static.net/uploads/4460980/normal_60648def0d9dc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/toguvaju/90397530579.pdf
    • https://uploads.strikinglycdn.com/files/66690345-3ab5-4330-a56b-2b886f6820df/24607556396.pdf
    • https://9df6e0af-a028-4e88-91ba-61a1b37318d5.filesusr.com/ugd/7c1f05_fb83c137d5c84b2bb5a9d80164e76eb7.pdf?index=true
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_b001846edf8645afb2940eca50f25ed6.pdf?index=true
    • https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_f6084ae381bf482a839a392c57ad402f.pdf?index=true
    • https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_4857ffc8eda44061b067b5fb95ba43ea.pdf?index=true
    • https://bef89f6e-6323-4b84-ad9d-a44490bfcc4f.filesusr.com/ugd/96768c_0a4ae1bfb5ec431db399ab2040666cb1.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8ab8f6c1-326d-4f88-912f-a0520a1cccca/what_is_the_best_example_of_newtons_1st_law_of_motion.pdf
    • https://1c437d0a-cccb-4a8a-93f1-39e0b5126915.filesusr.com/ugd/b91566_072c6b40e2594ed7bc511b751ef1628c.pdf?index=true
    • https://ba428ff1-d53d-4eb5-bdb2-cc960067f420.filesusr.com/ugd/7041e4_f6456140ff9b494c8022852ba6832ffd.pdf?index=true
    • https://s3.amazonaws.com/jesidofefe/zagg__bluetooth_keyboard_folio_for_ipad_7th_gen.pdf
    • https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_c400d00fcaed47058218a717184cf749.pdf?index=true
    • https://s3.amazonaws.com/zuponefi/likijazalagaromagudi.pdf
    • https://s3.amazonaws.com/tolivajupeku/29725855923.pdf
    • https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_81136ef936e04c24a6a3ee6e52e5ae96.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000150a7.bin
b42ab7a17be32f0e5e37c596f2bf73cb04095771f927f0c47226c002693ef803		 pdf-font-stream PDF embedded font (sfnt) at offset 0x150A7 5300 bytes
font_01_sfnt_off0001629e.bin
27596cae6d303d8f5da3c8222a1e5bcab2acaa80b18bcf87cbb188a96ca09e24		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1629E 14060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.