Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d19c8a8ed994c23…

MALICIOUS

PDF

68.0 KB Created: 2021-06-08 07:52:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 74c8500c1f6c0852fcd4d2c63459f5d0 SHA-1: 383f558dac51a3549ee7c2a4592d9b19b971bc52 SHA-256: 2d19c8a8ed994c23ea1199dbc63a9a5e8e6ed03012ec42d8734bb518291c0400
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. One of the primary links, 'https://crysiq.ru/pbw?utm_term=how+to+adjust+square+d+pumptrol+pressure+switch', is directly embedded and likely leads to malicious content or phishing pages. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9785

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/pbw?utm_term=how+to+adjust+square+d+pumptrol+pressure+switch
    • https://cdn-cms.f-static.net/uploads/4467005/normal_60b7a09a781b6.pdf
    • https://cdn-cms.f-static.net/uploads/4375503/normal_6068d039d877b.pdf
    • https://jafusakivamo.weebly.com/uploads/1/3/0/7/130739280/zakubuzolibe-gijanev.pdf
    • https://cdn-cms.f-static.net/uploads/4444102/normal_5fd2ca2a7821a.pdf
    • https://cdn-cms.f-static.net/uploads/4458631/normal_603ab08f895fa.pdf
    • https://dibikavo.weebly.com/uploads/1/3/0/7/130738915/a0b05997f91b63.pdf
    • https://static.s123-cdn-static.com/uploads/4491705/normal_5ff30ce0dfa65.pdf
    • https://cdn-cms.f-static.net/uploads/4387036/normal_6052523969510.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5f09e97e-da6a-4588-893b-10e420485fc6/90037108227.pdf
    • https://uploads.strikinglycdn.com/files/e2b51036-9fda-4d0c-8b66-d599bdfd3afe/girl_with_the_dragon_tattoo_movie_cast_2009.pdf
    • https://uploads.strikinglycdn.com/files/448d3fdc-0fb2-41f2-949b-53fdbf00acf8/6534315485.pdf
    • http://pivumiraw.pbworks.com/w/file/fetch/144837579/29576052456.pdf
    • https://uploads.strikinglycdn.com/files/f01d999f-adfa-4af4-9336-cdee09d68bdb/nancy_drew_and_the_hidden_staircase_movie_trailer.pdf
    • https://uploads.strikinglycdn.com/files/4b9d6460-d556-4960-87d8-6c4f58dfde1c/what_is_critical_thinking_in_education.pdf
    • http://zopujoxobug.pbworks.com/w/file/fetch/144411489/how_to_move_an_elliptical_up_stairs.pdf
    • https://uploads.strikinglycdn.com/files/a35fdbf1-e5e5-409f-a33e-5b7edd7de380/how_to_get_rid_of_pattern_day_trader_robinhood.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd6b.bin
d824e7c7e194e15c931509a463e710c97c4b93a0bba3a3f6c1632b34c44446ea
pdf-font-stream PDF embedded font (sfnt) at offset 0xDD6B 5568 bytes
font_01_sfnt_off0000f040.bin
4feb89b1cc081d4f3c8f13e66e892ee7246bb8216ade5a753755bc0e8cf4945e
pdf-font-stream PDF embedded font (sfnt) at offset 0xF040 10196 bytes