Malicious PDF — malware analysis report

Static analysis result for SHA-256 226136d6333a58e5…

MALICIOUS

PDF

84.4 KB Created: 2021-03-15 23:07:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca259d238e75313d6483bf0ba6ef9bdc SHA-1: 58f83119cfbd4695f9a3e0136671084c6fb7eb91 SHA-256: 226136d6333a58e5f96c09942108ac131ea5db5e4b276673bad210342a032d21
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are SEO-optimized, suggesting a link farm or phishing campaign. One prominent URL, 'https://nipisod.ru/strik?utm_term=schwinn+bikes+for+women', is presented as a search result, indicating a lure. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=schwinn+bikes+for+women
    • https://vujilesozigo.weebly.com/uploads/1/3/4/0/134042384/penuritidumiran.pdf
    • https://cdn.sqhk.co/zoboxoba/jbTieyp/plain_asbestos_sheet_size.pdf
    • http://rijunoje.mygamesonline.org/nezujevinobarekesabufekag.pdf
    • https://xomugiwonin.weebly.com/uploads/1/3/4/2/134266294/3f47a.pdf
    • https://cdn.sqhk.co/vekunego/4H1aibr/gravity_coin_pusher_game.pdf
    • http://sopesukenapad.scienceontheweb.net/how_do_i_turn_on_my_built_in_camera_on_my_hp_desktop.pdf
    • http://wupevijijoze.mygamesonline.org/nenabanewob.pdf
    • https://rixowumunek.weebly.com/uploads/1/3/5/3/135330445/wegojejaxafose.pdf
    • https://gefizubumob.weebly.com/uploads/1/3/4/4/134473977/wadig.pdf
    • https://cdn.sqhk.co/mutexeze/gZidgif/rainbow_galaxy_mirror_desserts_maker_cooking_games.pdf
    • http://wugupomovupa.sportsontheweb.net/22920794430.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7fe1f042-206b-4735-a408-f56337efeeb4.filesusr.com/ugd/d34b51_c89ea5ecd5f945d482e0f9ddbc76a5c5.pdf?index=true
    • https://6f847715-c85a-45d9-ae5c-7c68cc800588.filesusr.com/ugd/6e100b_e2e8d5661a5b42d7bf48f35c7782e35c.pdf?index=true
    • https://s3.amazonaws.com/tokudapele/72522889264.pdf
    • https://6d23287f-a15b-43b7-8d69-700c0e01f504.filesusr.com/ugd/185c00_edf42fddb85c4795a91cc0a87fd83716.pdf?index=true
    • http://fuxunowelujuxa.atwebpages.com/90625661305.pdf
    • https://uploads.strikinglycdn.com/files/35dd4869-1617-4e7f-b844-c3fd46d7adee/9827373063.pdf
    • https://s3.amazonaws.com/ruzaganog/colorlib_free_dashboard_templates.pdf
    • https://uploads.strikinglycdn.com/files/873ac9df-c8b1-4130-b0aa-e54ac2e8331c/how_to_manage_change_in_a_healthcare_organization.pdf
    • https://s3.amazonaws.com/sepovutapakogaf/66811158577.pdf
    • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_c06cd8522cbf44a19c650005fb409da9.pdf?index=true
    • https://44dd6259-7513-41c7-b2f1-b2b1fc385d2e.filesusr.com/ugd/63022f_adeef669ac09430ab85abcb703a925d8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/09eb14c9-5bd0-413e-934e-197e14e3a259/lenorudovukaf.pdf
    • https://s3.amazonaws.com/wajibile/dell_optiplex_gx620_cpu_price.pdf
    • https://s3.amazonaws.com/nuruvapozixix/matematica_financiera_capitalizacion.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d33.bin
46f330c7813be81bcb8d914689de69a5f31179d63782c97a74e350c6edc9d52a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D33 5276 bytes
font_01_sfnt_off00011f1c.bin
f5e1748b382b8106915a07874d2dd0e9d52dde57c3530bf0abf3fd4eaa81f728		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F1C 10856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.