Malicious PDF — malware analysis report

Static analysis result for SHA-256 32af4231f16d4739…

MALICIOUS

PDF

77.2 KB Created: 2021-04-28 14:25:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1c4113b33c304897488370a6844af7f6 SHA-1: b68e7acf5346ed384dbdafd02a770e22b9bd85b5 SHA-256: 32af4231f16d47391316af5805500f7fb6739fbeb70c737b85cedcc2ce89290b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including PDF_SEO_LINK_FARM and ML_NYX_PDF_MALICIOUS, indicating a high likelihood of malicious intent. The embedded URLs, particularly the one at `https://lozipotod.ru/strik`, suggest a phishing or spamming campaign. Although no scripts were explicitly extracted, the PDF structure and numerous external links point towards an attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=easy+recipes+for+vegetarian+lasagna
    • https://cdn-cms.f-static.net/uploads/4404969/normal_605f50d7c7d14.pdf
    • http://nojitowe.iblogger.org/english_story_book_download.pdf
    • https://static.s123-cdn-static.com/uploads/4415530/normal_5ff2a19741ef2.pdf
    • https://cdn-cms.f-static.net/uploads/4448986/normal_6025c14bb08df.pdf
    • https://cdn-cms.f-static.net/uploads/4454419/normal_6017db832a611.pdf
    • https://cdn-cms.f-static.net/uploads/4367635/normal_601ad5a63acba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_d20b6b74326546c082e0b1c470479e8c.pdf?index=true
    • http://ralabok.epizy.com/81200725360.pdf
    • https://ac402fee-74f4-49a6-b5a4-6a03c6a057de.filesusr.com/ugd/b0cd75_b31d5d45261f44baa5e0f109fb9af83f.pdf?index=true
    • https://d80f29e5-b60c-4034-b355-14c03cb49cca.filesusr.com/ugd/ff44ec_a690d865cf5b47bbbc84c0f7a248b999.pdf?index=true
    • https://6632aaff-1fe9-4f1d-acb3-7d444e457837.filesusr.com/ugd/ce4b7c_929d15e103b644e0b1b91354d5771c7d.pdf?index=true
    • https://abf133a7-37c0-4616-b653-d99fd306bce3.filesusr.com/ugd/5c8236_dacf78f94daa4d508fd8df8417adfab0.pdf?index=true
    • http://pupovedifa.rf.gd/rexek.pdf
    • https://351e5f87-f9e5-4015-92cd-d601692b9ec3.filesusr.com/ugd/a0d0d3_ae9858cb876b4cadb640d26837fe7ca9.pdf?index=true
    • https://ad5375d1-0dc8-447d-a54b-f1659eeba1ba.filesusr.com/ugd/a4ba79_93ed514910fb4af38b1b1149509bf3ab.pdf?index=true
    • https://a208a2de-cee2-48c2-86e3-c620a022946d.filesusr.com/ugd/dda32d_a94939b5614a4913966374e688df66a9.pdf?index=true
    • http://kisuneronebel.rf.gd/lspdfr_callouts_list.pdf
    • https://5be7aec3-7d66-433b-ae1d-2bfb807ddf2a.filesusr.com/ugd/24deb6_9f6d88bc9dee4734806e68056524b72d.pdf?index=true
    • http://nedufax.rf.gd/95028738876.pdf
    • https://c07b3cb0-7d4a-4e65-9c62-eb3bd0ce3b6b.filesusr.com/ugd/7560d5_dc836c3cc5f043ee9c6ff4edaa0c5839.pdf?index=true
    • https://69f6cc44-9198-4e41-bafa-43503dba92bf.filesusr.com/ugd/dec231_4030fcd2d9b140e9b2aa76a4bd41ae81.pdf?index=true
    • https://aaa8450b-5959-4376-bf95-5e5e4b45aab3.filesusr.com/ugd/bcfc74_b5e27abf5b6f45f29115586e5b4ac2e4.pdf?index=true
    • https://945b3f91-9c76-4178-be32-f0dab3cfe2c6.filesusr.com/ugd/8d5d69_47597372353a4120ad620628ca49da13.pdf?index=true
    • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_f9fe722e371f41b4be367da1afe7bcaf.pdf?index=true
    • https://87deab66-c645-46c6-955a-dbc2758d34a6.filesusr.com/ugd/302fc9_65ef4cdb7e454e31a3c2b644812db5f6.pdf?index=true
    • https://aa5f33e9-793b-4807-a257-9eac84d314d0.filesusr.com/ugd/aa57b2_d020de202a054fda80cbb222843c488f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f08f.bin
ce48d7e12f8d9635cc9454a2c907ce9aa0116031c00ca204b88bed3d122e5af7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF08F 5304 bytes
font_01_sfnt_off000102c4.bin
0807ae9f857f774dcc707ebc06ddf03c27cb15330518f9deffe75db828e2b565		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102C4 10704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.