Malicious PDF — malware analysis report

Static analysis result for SHA-256 635c7d6cde0d7453…

MALICIOUS

PDF

70.2 KB Created: 2021-03-31 14:03:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b00f80913777aff3113afe23f835961 SHA-1: 233e5e0f6706fd7255720d02de4c0734f336bbef SHA-256: 635c7d6cde0d7453d34306478dd6873a4df3331166bbbfea6f31f10606dc6cc9
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. One of these links, https://kuzutuzo.ru/strik, is particularly suspicious and likely serves as a lure. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=lord+of+the+flies+chapter+12+vocabulary
    • http://sipataj.sportsontheweb.net/what_is_the_best_skilled_trade_to_get_into.pdf
    • https://cdn.sqhk.co/zegapoxasut/hj4heii/injustice_2_mobile_character_tier_list_2020.pdf
    • https://cdn.sqhk.co/pafatewodoju/BgirFUE/car_engine_v4_vs_v6.pdf
    • http://lojapidabud.mypressonline.com/gefutodovoniziluratiku.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6f465708-eb37-4ee2-8658-ebeec6cd93ea.filesusr.com/ugd/4bb103_a7f560f525e94ee4978822499f9aa015.pdf?index=true
    • https://s3.amazonaws.com/wokesabisevo/disawudafugu.pdf
    • https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_f981387c1f904a2e9b0d68d833c861bf.pdf?index=true
    • https://9a4b5e96-23fe-4021-9525-787506808755.filesusr.com/ugd/b3318b_a414950032e54f648f8c94913ef6fd1b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/dd6cae02-01a0-4a24-b14d-46e43bb22904/losoreruluxiwazo.pdf
    • https://s3.amazonaws.com/xoxaneral/army_apft_score_sheet.pdf
    • https://0298dc5a-7924-4276-8279-06452a5288da.filesusr.com/ugd/b30cf0_7ef333ebbb8e48e7a43966583993c02b.pdf?index=true
    • https://s3.amazonaws.com/fogibi/rogesurikibisikupezisus.pdf
    • http://kubomefewofumim.atwebpages.com/lewopifikamasujubukowakuj.pdf
    • https://uploads.strikinglycdn.com/files/8b88efd3-2a79-4d94-8ba7-e4dc90410317/rozoworazobu.pdf
    • https://8137cd1e-393d-4948-8193-eca935452849.filesusr.com/ugd/756799_827f9d7cb84746ae9115f8b98652d42f.pdf?index=true
    • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_d51746cddbfb404d9faacadaee115335.pdf?index=true
    • https://s3.amazonaws.com/fulosobezur/jazaz.pdf
    • https://s3.amazonaws.com/vojapu/bivopekujeva.pdf
    • https://65d0a56f-4074-4e8f-9acc-29e6f8e8f663.filesusr.com/ugd/37655d_c8b5fa0a040d499b95d6590df046665e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8cb6792e-071d-472a-b943-576eea58be3b/83393449416.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d611.bin
aefc728571a4fda372253dff7faea3a7b125969f938dcb82b6c95163629c9b48		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD611 5672 bytes
font_01_sfnt_off0000e966.bin
dc61608396cc8b0b19589cb23365db5018b54d5618476ac0d6b0f667fd8687c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE966 9944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.