Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cada57e2d1d42ae…

MALICIOUS

PDF

80.0 KB Created: 2021-05-03 07:53:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 324bde0d0c834a1786b62cc40ee785eb SHA-1: ca2a86dd1527b9968e287faa6889aedce2ff4c33 SHA-256: 5cada57e2d1d42aeadf6b0d311d648b2ee0b51585e67d0e5a86bde076ce422f8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with one prominent link pointing to a suspicious domain ('lozipotod.ru'). The document body, though heavily obfuscated, appears to be a lure related to 'Bush and gerts baby grand piano value', suggesting a phishing or scam attempt. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external links indicates a link farm or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=bush+and+gerts+baby+grand+piano+value PDF link annotation
    • https://cdn.sqhk.co/vapezuwe/hegjc8a/fovexewid.pdfIn PDF document text
    • https://cdn.sqhk.co/gotofebelu/ahaNGic/mini_bowling_ball_kerosene_lighter.pdfIn PDF document text
    • https://cdn.sqhk.co/nawamuzimosu/ijgjgf7/final_fantasy_7_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/rumoligodo/xja2jfa/duvijixagamef.pdfIn PDF document text
    • https://cdn.sqhk.co/janawezexoj/cNCdYcW/72558104853.pdfIn PDF document text
    • https://cdn.sqhk.co/vonirosidejo/hhijmgh/daxejibe.pdfIn PDF document text
    • https://cdn.sqhk.co/puxobaku/hFHRghg/daboduzejuzewixidexow.pdfIn PDF document text
    • https://cdn.sqhk.co/datolabevev/jjidg5m/62646287885.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_c0b65128b8d54d07b6d8a49022ef981a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d28fc5d-52a0-4e19-8bfe-9b37357f4ce3/sylvia_plath_poems_ariel_collection.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6d25d31-27db-4529-800d-29a7f428fa47/7868345029.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c1f14d7-f9dd-460a-a84e-ddad92e87c9a/cateye_wireless_bicycle_computer_with_cadence_and_heart_rate_monitor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5e0e11f-d627-4340-aab6-a3cbede6d396/mawetuxasiwoxumadut.pdfIn PDF document text
    • https://71fc3d66-43b2-4ae0-adc3-dfbcdf8b5360.filesusr.com/ugd/6605a0_a727ae01fe934d27b222855c74978d89.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/adda4b1e-52cc-4698-9e9a-ec33fa1700c1/57670059440.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e9c6f68-1121-4312-8fee-da67fc0467bf/25090522915.pdfIn PDF document text
    • https://9e7b01ce-91ce-414a-93c5-ade8df4b7359.filesusr.com/ugd/cfbfd2_73113c38438f40249bea68ed932df44f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cae4695-f855-494f-93ab-a0925bee7398/what_is_the_basic_principle_of_wind_energy_conversion_system.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83f56836-b729-4fa5-80c1-f4ca70342658/how_to_make_6_figures_in_2_years.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e8b2b65-6c3f-43fd-971b-2f0db3825d0e/19894207365.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fecfc8b4-6354-46b8-a077-f64aae71d69a/biblical_timeline_old_testament_chart.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f714.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF714 5572 bytes
SHA-256: 8db6a1ca851d6c412c08c1172411480df3b735d6682b88a0ee75646dae945224
font_01_sfnt_off00010a0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A0A 11412 bytes
SHA-256: 8916b58c07de46207c5a3fac55a0d78be299d973fb5eb3e2a163977250251967

Open this report in the interactive analyzer, or submit your own file for analysis.