Malicious PDF — malware analysis report

Static analysis result for SHA-256 59896996ee0418c8…

MALICIOUS

PDF

71.8 KB Created: 2021-03-31 03:55:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 032673df185fd15077d898e6a285bff9 SHA-1: 9e5995c7fe71bd590e55e05c8a84ceb5c1b0f678 SHA-256: 59896996ee0418c8f2b712f11ec5f3a82d166b2b28b04fc3e230dcb32592eaa9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document exhibits characteristics of a phishing or scam attempt, indicated by the 'PDF_SEO_LINK_FARM' heuristic and the presence of numerous external URLs. The primary malicious URL identified is 'https://nipisod.ru/wix?keyword=download+instagram+bot+followers+apk', which likely serves as a lure for unwanted software. The ML classifier and ClamAV detection further support its malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=download+instagram+bot+followers+apk PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4443812/normal_5ff498e8be4d6.pdfIn PDF document text
    • http://collegegraduatecentraldating.com/65466058705fbffh.pdfIn PDF document text
    • http://wgathering.org/how_do_i_find_my_hp_printer_wifi_passwordqh9yn.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415537/normal_5fe73166d99dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367013/normal_6020a122f188b.pdfIn PDF document text
    • http://uscarins.info/how_to_fill_a_vicks_warm_mist_humidifiertl663.pdfIn PDF document text
    • http://prizinsta24.site/on_my_own_song_ashes_remain0ggwj.pdfIn PDF document text
    • http://digitalcalakk1.xyz/how_to_get_supply_chain_management_certificateh9jfi.pdfIn PDF document text
    • http://dvestideyli.xyz/vagiwudarobovureduxepe8ga4r.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374380/normal_5ff4f571ab8a6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a7ed8af5-5e4a-4eaf-98d7-51655494ca15.filesusr.com/ugd/b5c45a_f51c75559f14418f9005e9c60dd1aa4f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dafumuxitupav/72821779357.pdfIn PDF document text
    • https://5057b38b-f250-4925-a5fd-2dbc054a2c1f.filesusr.com/ugd/25ee37_84b75561cc304a0eae49474c54690009.pdf?index=trueIn PDF document text
    • https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_e8338b3959f54b55bcef35d3bae26891.pdf?index=trueIn PDF document text
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_a122ea712a8946c2a1bc733bd2e141f7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kokesatodixon/ipl_2019_schedule_time_table_pic.pdfIn PDF document text
    • https://s3.amazonaws.com/bogeguva/vidmate_hd_video_er_live.pdfIn PDF document text
    • https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_f6364286df0045e8836980fb1a257552.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/miledu/26954858699.pdfIn PDF document text
    • https://s3.amazonaws.com/lerezazo/picsart_background_hd_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jifedefujodu/gijoxiwesegotixolupavil.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dabd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDABD 5656 bytes
SHA-256: 5dd52c8e52e6d029a91f4fa603b0e92962888a865115bbeda684400097fb1b03
font_01_sfnt_off0000edfe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDFE 10596 bytes
SHA-256: dccbc2f84628efebcb467ae85e5968f1cebd19be03d9b7c66031fef013cc5227

Open this report in the interactive analyzer, or submit your own file for analysis.