Malicious PDF — malware analysis report

Static analysis result for SHA-256 30bcb1c7658ec947…

MALICIOUS

PDF

72.2 KB Created: 2021-04-12 08:42:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ce905ffc8884c3307bec1fa1667dd2f SHA-1: 7f788429e9f58ab205e25fe3d9db34387dfb7394 SHA-256: 30bcb1c7658ec947a85d3ab84338b66c79518f50609f973ef239ea6bca5c29b6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm. The primary URL, 'https://kuzutuzo.ru/strik?utm_term=how+to+replace+a+braun+oral+b+battery', suggests a lure to a malicious site. ClamAV detection and ML classification further indicate malicious intent, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+to+replace+a+braun+oral+b+battery
    • https://girusetobar.weebly.com/uploads/1/3/1/0/131071114/d298ff.pdf
    • http://xobezised.iblogger.org/xiguwirewotibikefamitiz.pdf
    • https://tudegikugil.weebly.com/uploads/1/3/5/3/135317618/guliger-fiwiluruz-godepujazeleb-sibipuw.pdf
    • https://fapurexetekuwud.weebly.com/uploads/1/3/4/5/134508670/finijesexomebuv.pdf
    • http://viniveba.mywebcommunity.org/33695822256.pdf
    • https://reponobokuwe.weebly.com/uploads/1/3/5/4/135401207/zagewapozun-pizolivigup-bipilo-tazosiketezal.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://miviguwi.epizy.com/xexilafavesulobotanudi.pdf
    • http://gofosuxubajo.epizy.com/rugirizutimobug.pdf
    • https://uploads.strikinglycdn.com/files/80c3baa7-4b1f-46f2-91ce-b54739b667e4/how_to_find_probability_statistics.pdf
    • https://uploads.strikinglycdn.com/files/5b3612da-85bf-4f51-9c95-484a95bcf259/how_to_create_json_config_file_in_python.pdf
    • https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_afa1752416ba4f7e9ca78ced9dfd5dba.pdf?index=true
    • https://f3ea461b-95fd-44cf-949c-5afda193840f.filesusr.com/ugd/a48928_e22271eb2ccc4a4985d8d539b073e895.pdf?index=true
    • https://s3.amazonaws.com/xumakomowi/vozaf.pdf
    • https://uploads.strikinglycdn.com/files/346de037-63ad-4502-939a-05198c199836/92715645236.pdf
    • https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_539bdc581f7f47cb94c3ac8e9009dbc1.pdf?index=true
    • http://pogedezibak.rf.gd/socialism_communism_and_capitalism.pdf
    • https://37d20dde-80dc-45a1-8224-77eeb5e9759a.filesusr.com/ugd/bcd086_cb0a71d52d0b4be2a988fa48dcc94047.pdf?index=true
    • https://s3.amazonaws.com/dukavunivifa/96860402119.pdf
    • http://wovuluvoju.onlinewebshop.net/tivamig.pdf
    • https://s3.amazonaws.com/sivanira/depabizewekijugonipu.pdf
    • http://najejofimepesef.epizy.com/business_english_handbook_advanced.pdf
    • https://uploads.strikinglycdn.com/files/76bac99b-ff75-4592-b5c1-e0d66b8f4692/twilight_eclipse_cast_renesmee.pdf
    • https://s3.amazonaws.com/jolituzoji/xumemivolurikakor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd64.bin
989aee6e1c0e8c8820baf4e46710a37303ae053dd0173b2fd491e34ee866ee99		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD64 5044 bytes
font_01_sfnt_off0000eead.bin
5f7eef315410b5efa2920970af16944beaebc86add8d36a3a6fc0b9f8c69d782		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEAD 10296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.