Malicious PDF — malware analysis report

Static analysis result for SHA-256 527d9ecb68c13240…

MALICIOUS

PDF

83.3 KB Created: 2021-03-21 07:35:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d17fbe30f683ebd6ad0ff7789ced86d SHA-1: 7d4d87267f4712e3d3ee70185d2be1a45632c8d9 SHA-256: 527d9ecb68c132402a74d010cda62de179d53afd2a392260ea2d9fc1ceee60f6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical PDF link farm detection and a ML classifier indicating maliciousness. The presence of numerous external links, such as http://techanomic.com/39805162855yteek.pdf and https://nipisod.ru/strik?utm_term=stihl+weed+eater+head+won%2527t+stop+spinning, suggests a phishing or redirection attempt. The ClamAV detection as Pdf.Phishing.Trojan further supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=stihl+weed+eater+head+won%2527t+stop+spinning
    • http://techanomic.com/39805162855yteek.pdf
    • http://hiziryigit.online/somamefodemofenajigobemomkvgr9.pdf
    • https://cdn.sqhk.co/vapumojemov/oSTEgco/baby_yoda_desktop_wallpaper_4k.pdf
    • http://nout-prodat.site/kotaludijizakuxejuuzuex.pdf
    • https://cdn.sqhk.co/jalivotenos/egj8kBO/segegonadidaniwemuv.pdf
    • https://cdn.sqhk.co/japexexuko/iidgdIu/dungeons_and_dragons_character_sheet_3._5_editable.pdf
    • https://cdn.sqhk.co/fafojipedul/idcWheu/amazon_alexa_dot_4th_generation.pdf
    • http://pedron.fun/lovely_complex_episode_1_english_dubbed9ke2p.pdf
    • https://cdn.sqhk.co/sirepajaku/aibig1C/sazerizedisatexikipuzabe.pdf
    • https://cdn.sqhk.co/gimexigerub/02ia8if/battlelands_royale_hack_iphone.pdf
    • https://cdn.sqhk.co/tumowara/ZRLgjLZ/nasa_spacex_crew_dragon_return_schedule.pdf
    • https://cdn.sqhk.co/xufatirumina/cheierU/30075075226.pdf
    • https://cdn.sqhk.co/voravaxa/ecEADhg/bofopero.pdf
    • https://cdn.sqhk.co/minofavazu/gU6Cc57/orange_slice_candy_pound_cake.pdf
    • http://fruitnaturs.space/65055984019a1axr.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_56a2eda6b59d4afc88344f954e83ea70.pdf?index=true
    • https://df1882fa-13c5-42f1-8438-577935b594b9.filesusr.com/ugd/91932b_65fa36b2e33541e1bbfb7f64f6d815b1.pdf?index=true
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_e51946da55cc4a87ac445aaa4aa3793c.pdf?index=true
    • https://6ba7316d-b84b-4ccb-a32a-103c856d4013.filesusr.com/ugd/91f37e_f2d120d3300345cca0f4f66bc5df15bd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6bc6a044-3e75-411e-a434-33c8b0381562/blackjack_strategy_card.pdf
    • https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_0783e5351c524741b64da46587826c01.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0b2c1c43-174d-41f8-87d1-f755f5988478/jatoromoroxozonogawik.pdf
    • https://uploads.strikinglycdn.com/files/3bd85c7f-112e-48a6-b806-a028a69aacd0/76877359270.pdf
    • https://6448a590-b571-4b71-a9e4-820b8531b153.filesusr.com/ugd/782be2_b12cdd86789b473892668fa5690b7ed8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a7d9e70f-3fa8-419d-bc79-8515594f2daf/65063836822.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001059d.bin
e1dc12d01eec20109a09d5a373042f1ff86583123e26bab5dd120efdf119f4bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1059D 5452 bytes
font_01_sfnt_off00011835.bin
8efafd008bbef08061c6a7527f8e4a4c2b227ff6cbcb2a914cf644499123bbf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11835 11620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.