Malicious PDF — malware analysis report

Static analysis result for SHA-256 5576ca309131d947…

MALICIOUS

PDF

89.0 KB Created: 2021-05-25 15:58:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ffe73181dc9227f1c9a6abcccb94dc50 SHA-1: d1a236d184d489c7adfdc18d5b503a49ecb7749f SHA-256: 5576ca309131d9477e38ce9dfb696423f32b7e9d648501cea218216c019060d8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, with the primary malicious URL being https://kuzutuzo.ru/strik. This suggests the document is part of a campaign to drive traffic to potentially malicious websites. The ClamAV detection and ML classifier further confirm its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=tamil+typewriting+tutorial+pdf
    • https://cdn-cms.f-static.net/uploads/4496826/normal_5fd68a17053a5.pdf
    • https://rolorizumi.weebly.com/uploads/1/3/4/3/134316308/d87af3d8226b.pdf
    • https://gawajofanobovap.weebly.com/uploads/1/3/5/2/135296378/bc23c21105c1f.pdf
    • https://cdn-cms.f-static.net/uploads/4476274/normal_605c495f82223.pdf
    • https://cdn-cms.f-static.net/uploads/4366397/normal_605a7cf40ddaf.pdf
    • https://cdn-cms.f-static.net/uploads/4446174/normal_601bff247e0bd.pdf
    • https://cdn-cms.f-static.net/uploads/4460476/normal_603fb06d8c4e6.pdf
    • https://static.s123-cdn-static.com/uploads/4469359/normal_5feb43123e783.pdf
    • https://cdn-cms.f-static.net/uploads/4464083/normal_601f1c04a6109.pdf
    • https://cdn-cms.f-static.net/uploads/4412159/normal_6027d57deb4e2.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b717596f-29b4-47cf-8493-03ef462685be/87062812049.pdf
    • https://uploads.strikinglycdn.com/files/608b036b-a342-408a-b681-7fceab59559a/experience_and_education_citation.pdf
    • https://uploads.strikinglycdn.com/files/5071cc00-f33b-4072-89fc-6583b27d0b87/53652304098.pdf
    • https://uploads.strikinglycdn.com/files/57f3c80b-5926-4fad-b4aa-d79164e46d4a/68087430152.pdf
    • https://uploads.strikinglycdn.com/files/5a9f639f-5742-462d-8fdb-3a258e061ba2/snare_rudiments.pdf
    • https://uploads.strikinglycdn.com/files/c164c59f-fead-43f3-a186-b058a482e4dd/atlas_lathe_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/6a2778b9-55b5-46ba-a18b-139b1753569b/94328522614.pdf
    • https://uploads.strikinglycdn.com/files/ffb673a1-061f-4b8f-a925-63d76a2e91a5/tokalumudikusex.pdf
    • https://uploads.strikinglycdn.com/files/8dc4aaac-5336-4d91-998e-360cfb7816a2/nojugobiwevadeteridutel.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000fa0e.bin
3a135c936007397d9bb0fc9bbe8f9a021bc9141c057f70a1996c1a681a72d7c6		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xFA0E 27340 bytes
font_00_sfnt_off0000e7ec.bin
9b0be714950d2e6f0a699612da01423b6b9633bc26fcebeef06eb8eb9317b85f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7EC 5328 bytes
font_02_sfnt_off00012ea2.bin
0b7fcf5572a6ea3675733934cc08f9ed25557ec7fa3846b0242e40bdf01986fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EA2 11676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.