Malicious PDF — malware analysis report

Static analysis result for SHA-256 518f1fbfc1bae643…

MALICIOUS

PDF

77.7 KB Created: 2021-03-16 21:25:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9427c6c272350fa99ebe1b116d2405ce SHA-1: d73f23c9542102259e3fe4e29f739caeab6c405c SHA-256: 518f1fbfc1bae643a7560dbf9c22f9d566195126d73b1a9a7b4b2f0a6497aa51
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains numerous external links, including one to 'jumiwimov.ru' which appears to be a link farm or phishing lure. The PDF structure and embedded links suggest an attempt to redirect users to malicious sites, likely for phishing or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=spotify+old+version+apk
    • https://static.s123-cdn-static.com/uploads/4489716/normal_60076732f0333.pdf
    • http://xejitifuwoligaf.mypressonline.com/minority_stress_scale.pdf
    • http://teenagetutor.net/43626751215ewt6i.pdf
    • http://bosnoslovnoejelaniekupit.xyz/44041550574msaf0.pdf
    • https://static.s123-cdn-static.com/uploads/4366653/normal_5ff58bae13874.pdf
    • http://ita-talia.fun/plex_windows_clientoyp6z.pdf
    • https://cdn-cms.f-static.net/uploads/4369904/normal_60424331ed05d.pdf
    • http://jiwapadenejeza.getenjoyment.net/belabaj.pdf
    • http://tefitagesev.mypressonline.com/who_were_the_third_estate_in_france.pdf
    • http://tufofol.medianewsonline.com/velisaritadezupipedewi.pdf
    • http://love-your-lips.online/paguwegaranawurogogababigwaxj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_03209f162670492087ea7bf3ddd0f6bb.pdf?index=true
    • https://2eeb51df-07ba-4372-80d9-1ef4646fc7f7.filesusr.com/ugd/6af210_e5eae99078a84e8096543ff384e1bcbc.pdf?index=true
    • https://s3.amazonaws.com/tisegovofu/how_to_get_the_html_code_from_wix.pdf
    • http://majezomisi.myartsonline.com/70617012922.pdf
    • https://983c8978-ad56-435f-a988-47358aa6040c.filesusr.com/ugd/06a663_59b2e9066f1a4bc4b0dc53ca5db35817.pdf?index=true
    • https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_e6570038d44642339eb4b7a7ddfd7278.pdf?index=true
    • https://s3.amazonaws.com/posufij/75950310363.pdf
    • https://s3.amazonaws.com/lolaritemukole/48991991151.pdf
    • https://0dea665b-aaaa-42f3-a52c-f86f0fd1efa2.filesusr.com/ugd/8b9728_f83d3bea274b464d9fddf064b54fd7d3.pdf?index=true
    • https://9a4203bb-6ff2-4ef1-9c63-3f113f84a884.filesusr.com/ugd/ea9bdf_840f1b577e204d5a8ac79d7bc1ed1da8.pdf?index=true
    • https://ede8a7a3-2377-4e09-926a-401222b31c25.filesusr.com/ugd/81c89d_925090bb8adf45a5b0672d9f6fa2ccbd.pdf?index=true
    • https://s3.amazonaws.com/xowasosuf/donide.pdf
    • https://dc383e6d-b7a3-4e67-a88a-227fa542b6c3.filesusr.com/ugd/72b0e7_9ad0d26afeba42f5b5df00cf80302c82.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f161.bin
31748050ebf4bad376848006a4e5d57edf600d13fb558ddbccb1ca0796ad1df6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF161 5364 bytes
font_01_sfnt_off000103c0.bin
e99950a844f5035206043deab178df99020e4aef7068f9179a4e0f826398dbd7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103C0 10996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.