Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fa7a96e0531b240…

MALICIOUS

PDF

80.6 KB Created: 2021-03-18 09:18:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 651e8433ceb878c7d5bd53590c14d26f SHA-1: 4252d8e9fc6ae62da0585f065a233ed849bce7cc SHA-256: 5fa7a96e0531b240e9f27da4f5bcaa2b51d3a19757646154acffc6517f79ecec
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, indicating a link farm designed for SEO manipulation. One prominent URL, https://jumiwimov.ru/wix?keyword=negative+velocity+vs+time+graph, is likely part of this scheme to direct users to malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=negative+velocity+vs+time+graph PDF link annotation
    • http://tarigutese.mygamesonline.org/66307897602.pdfIn PDF document text
    • http://suxoxaxowigab.scienceontheweb.net/dd_classes_3.5e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413977/normal_5ffe49812a4fb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4497358/normal_5fdd3df45e10a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443357/normal_60483de59c10f.pdfIn PDF document text
    • http://gejokakop.mygamesonline.org/41579489539.pdfIn PDF document text
    • http://zisapawiwako.mypressonline.com/maria_emilia_caballero_cadenas_de_markov.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_aac1b2fbeb98425187ac3a6a0ecd7270.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sugowubuf/29517562187.pdfIn PDF document text
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_d8504d61fc854f5cb6cee3f81f48326c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/doxifuba/zoom_g5_vs_boss_me_80.pdfIn PDF document text
    • https://s3.amazonaws.com/nafibanefexex/crusader_of_light_mystic_healer_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/55942549498.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49c4fd63-f8a2-49fc-9f6a-e8a506675bc4/vetekiwun.pdfIn PDF document text
    • https://4a5660cc-52a2-48ff-9acb-4b4f1704cb6e.filesusr.com/ugd/81868d_776347169e87497fa6f6e95ee60ee6d8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cabb6470-572f-40d1-b60a-feed9697d467/how_to_read_the_financial_statements_of_a_company.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab9abf4f-b933-4a8f-bdb6-b228b1152b7b/51573533742.pdfIn PDF document text
    • https://146c8b6c-0b46-450b-8ed0-b45f1e2a4974.filesusr.com/ugd/b58d21_a103ae51d3474b3eb646e234826b9699.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/889867bf-791c-43c4-9200-2826b076f6ee/2005_polaris_sportsman_500_ignition_switch_wiring_diagram.pdfIn PDF document text
    • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_6ffc0c6c0f9b48bb911248852b40575e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mafavuzenoliki/zapotisavubepi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25a64f81-1c04-4949-b04e-9ef5e5d5b6b0/the_monkey_king_3_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e2f10c4-4b3f-4429-be9b-08ce573e3ce4/flight_simulator_xbox_one_cost.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000feb2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEB2 5476 bytes
SHA-256: 7bb12226637e49e0cef255bc7d58a5990c22525a8c4a195ef2ac13815de41c05
font_01_sfnt_off0001113c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1113C 10508 bytes
SHA-256: a4c8ec1a24d2e8c3f02a2eb812a514f541ddd0ff4501775ee5b3a06fa979e1e5

Open this report in the interactive analyzer, or submit your own file for analysis.