Malicious PDF — malware analysis report

Static analysis result for SHA-256 4558612559b8a544…

MALICIOUS

PDF

80.0 KB Created: 2021-03-28 21:49:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1e470de184c5421e4d0f219c369fd6db SHA-1: ef3aeaee53287bd334061ba654ee16faa12aae37 SHA-256: 4558612559b8a54498983e4f57092d8c582d04ce8093e4f9d369a1707a638c7a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL pointing to a suspicious domain ('nipisod.ru') that is likely used for phishing or malware delivery. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting an attempt to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+draw+a+cool+dragon+easy+step+by+step
    • http://luvatok.66ghz.com/uefa_champions_league_2020_schedule.pdf
    • https://cdn-cms.f-static.net/uploads/4392220/normal_6048203568341.pdf
    • https://cdn-cms.f-static.net/uploads/4490936/normal_5fdad6b0c0978.pdf
    • https://cdn-cms.f-static.net/uploads/4485704/normal_604632c9c57a3.pdf
    • https://cdn-cms.f-static.net/uploads/4369911/normal_6056fc095eabb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://441768bb-9839-4df4-8f78-dd1233b527f6.filesusr.com/ugd/7e6080_9d3d07b987b547ea833de8c3f8ccbf6a.pdf?index=true
    • https://s3.amazonaws.com/lebejos/36096579567.pdf
    • https://s3.amazonaws.com/jemazejodep/diablo_3_botting_guide.pdf
    • https://s3.amazonaws.com/vipinib/2447165492.pdf
    • https://ac402fee-74f4-49a6-b5a4-6a03c6a057de.filesusr.com/ugd/b0cd75_34ad4b74f10244c1802ee7ee133fccfa.pdf?index=true
    • https://c580675e-8888-491d-8c80-3106eaac86fb.filesusr.com/ugd/c8a981_1246a8d3a76f49eab039bb3fcfdd5a9d.pdf?index=true
    • https://s3.amazonaws.com/memobofilenabon/31897294489.pdf
    • https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_48db4e34c9f24624983e151062df3706.pdf?index=true
    • https://s3.amazonaws.com/zowejunef/hyrule_warriors_legends_illustrations_guide.pdf
    • http://pilujuzaxerek.rf.gd/49057889199.pdf
    • https://s3.amazonaws.com/bokofapig/adobe_after_effects_templates_videohive.pdf
    • https://s3.amazonaws.com/sazixipame/nugedazaj.pdf
    • https://s3.amazonaws.com/wibedubosateg/show_outlook_calendar_on_android_lock_screen.pdf
    • https://s3.amazonaws.com/wonumafubij/badger_meter_pc100_manual_espaol.pdf
    • https://s3.amazonaws.com/faduxodiwo/tudibebojenipuvixewep.pdf
    • https://ca483b97-61ac-4196-bca0-6b249c18eca9.filesusr.com/ugd/b27199_1564969e697a4535a75b5a6a522a33ee.pdf?index=true
    • https://s3.amazonaws.com/mikibetiv/fullstack_react_native_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbd4.bin
c262e117811cb4f97c23db87cfc208a667fbc473ccc5385f9988c5eaeac19a3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD4 5536 bytes
font_01_sfnt_off00010ec4.bin
49ae7dad6f0c38a39a96e0d94150a3d8a744a2c24c2df7cf1092fea4f98acc05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EC4 10488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.