Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d67ece136ba8c55…

MALICIOUS

PDF

80.4 KB Created: 2021-05-17 12:22:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a039d34ba8ff0786eecc99091ec0f1e SHA-1: 94a0550bd8942bc2fdcad67a15fed2762893a63a SHA-256: 5d67ece136ba8c556287fc785e6844fd564976226fc8b70da2f76343750e19e8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, identified as a PDF link farm. The primary URL, https://jumiwimov.ru/strik, is likely part of a phishing or SEO manipulation scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=how+to+perform+needle+maintenance+on+your+keurig
    • https://gibejuta.weebly.com/uploads/1/3/0/7/130776113/9567732.pdf
    • http://jitokinut.iblogger.org/italian_renaissance_architecture.pdf
    • https://filafibiwi.weebly.com/uploads/1/3/4/3/134316544/5121638.pdf
    • http://tazasimeli.22web.org/54339101094.pdf
    • http://jimurizo.22web.org/cafe_bazaar_mod_apk.pdf
    • https://jexelokase.weebly.com/uploads/1/3/5/3/135321670/c421506.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tapewiwesumufug.epizy.com/648292944.pdf
    • http://bixivanudupona.epizy.com/systme_bielle_manivelle_exercice_corrig.pdf
    • https://s3.amazonaws.com/vufupu/how_to_use_an_electric_ice_cream_maker.pdf
    • http://zijubeda.rf.gd/16252707226.pdf
    • https://s3.amazonaws.com/jojitagifuva/sinoxenuwadaratekidinapa.pdf
    • https://s3.amazonaws.com/makumapikeze/user_manual_for_samsung_a10_mobile_phone.pdf
    • https://s3.amazonaws.com/fumiposamisur/conic_map_projection.pdf
    • https://s3.amazonaws.com/vosimalume/mijovafijurilibijezapuvo.pdf
    • https://s3.amazonaws.com/jofunozuzof/terras_do_demo_aquilino_ribeiro.pdf
    • http://jajapelemazibog.rf.gd/charles_schwab_401k_beneficiary_designation_form.pdf
    • https://s3.amazonaws.com/vonutavekip/report_folders_amazon.pdf
    • https://s3.amazonaws.com/miledu/powerpoint_templates_business_envato.pdf
    • https://s3.amazonaws.com/fekaduvopigab/60055756808.pdf
    • https://s3.amazonaws.com/gixawetopoli/the_mortal_instruments_city_of_bones_book_free_download.pdf
    • http://fobajoruvibu.epizy.com/bluestacks_android_emulator_for_ipad.pdf
    • http://sidigoxe.rf.gd/bill_gates_books_in_urdu.pdf
    • https://s3.amazonaws.com/muvojugejoxip/gekiligezigabame.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbe7.bin
238504000f95df8792237c80c50a7ea5b552688ee0a5d7e0c610f3bf268a4f09		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBE7 5516 bytes
font_01_sfnt_off00010eb0.bin
c96bcd2be03f84d5a7e61ecf275aa906967e49494090c8f5a7556b54ff3ae012		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EB0 10948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.