Malicious PDF — malware analysis report

Static analysis result for SHA-256 5905db0b69e6d328…

MALICIOUS

PDF

89.2 KB Created: 2021-04-06 14:28:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e67c20a1ecb94d0569c26bf90f7bc118 SHA-1: b99b2fdce8bcf9bc10a68c23e6b3d03baa008d96 SHA-256: 5905db0b69e6d32822c42a6a9153963048e8ff9b70f11cdaa4b936da2db717e0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic firing. One of the primary URLs, https://nipisod.ru/award?keyword=breckenridge+piste+map+pdf, is suspicious and likely leads to a malicious site. The ML classifier and ClamAV also flagged this PDF as malicious, suggesting a phishing or trojanized document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=breckenridge+piste+map+pdf
    • https://static.s123-cdn-static.com/uploads/4500887/normal_5fcec0c32d77a.pdf
    • http://zotonurapad.22web.org/11265620030.pdf
    • http://popujizok.22web.org/braced_cofferdam.pdf
    • https://cdn-cms.f-static.net/uploads/4448735/normal_6014202021fc2.pdf
    • http://sesugato.iblogger.org/sebopajexusiso.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mikibetiv/busokixuruledupogofabeg.pdf
    • https://uploads.strikinglycdn.com/files/d4d5e5bf-c75f-47b5-93ca-deee7874b619/how_to_start_dental_hygiene_school.pdf
    • http://tekojexabutixas.epizy.com/open_mind_beginner_a1.pdf
    • http://gazavitiji.epizy.com/mofimisunepewa.pdf
    • https://uploads.strikinglycdn.com/files/18fd36ce-8a0e-4ea1-a1ed-0149f11b3c27/timex_expedition_watch_battery_cr2016.pdf
    • https://5548a280-a194-4776-8019-0e256783c1fa.filesusr.com/ugd/f2c1dc_7a9e17a742ea40c49cadc1d890234f06.pdf?index=true
    • https://s3.amazonaws.com/xeroguru/century_gothic_truetype_font.pdf
    • https://s3.amazonaws.com/mejados/medical_terminology_identification_worksheet_answers.pdf
    • https://s3.amazonaws.com/rurovikejigibu/75279994834.pdf
    • https://aa4c2489-c93b-4667-afab-104bf5323bad.filesusr.com/ugd/8b49c6_03a50dae040549a99a0013d89d3411d4.pdf?index=true
    • https://s3.amazonaws.com/tapexiw/adobe_acrobat_reader_win_8.pdf
    • https://e6b56e3c-1b88-4cfb-972d-ab1702b0a06e.filesusr.com/ugd/8c0e65_b15f501c002e40bb8d9880b7a9744584.pdf?index=true
    • https://s3.amazonaws.com/suxugipipolazog/67657264197.pdf
    • https://s3.amazonaws.com/falevi/minn_kota_riptide_55_transom_reviews.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011f7f.bin
b699153499c0ddb987b980ccdf80a66a85a6370e8e309436009b0c3bdbacbf51		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F7F 5556 bytes
font_01_sfnt_off00013257.bin
a4fa5d3ccfa38769b75c53d46ddef17752b1da9ec2bddf0c64273649915b11c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13257 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.