Malicious PDF — malware analysis report

Static analysis result for SHA-256 63cefa5c0aa10ace…

MALICIOUS

PDF

82.1 KB Created: 2021-04-05 18:47:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9b28dea43606bf9922ca2a4ac5483aff SHA-1: baae0279e867f51a9328ae04626711cc499e05de SHA-256: 63cefa5c0aa10acea66c74f493781fe210368c90e48d37dd79f370e4fcea0789
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with a critical heuristic identifying it as a PDF link farm. The primary URLs extracted, 'https://kuzutuzo.ru/strik?utm_term=is+parallel+parking+on+the+driving+test+in+ny' and 'http://eroganoficial.site/what_is_subordinating_conjunctions_examplesnp0l0.pdf', are suspicious and likely lead to malicious content. ClamAV also detected this file as 'Pdf.Phishing.Trojan'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=is+parallel+parking+on+the+driving+test+in+ny
    • http://eroganoficial.site/what_is_subordinating_conjunctions_examplesnp0l0.pdf
    • https://cdn-cms.f-static.net/uploads/4426066/normal_603a096c31271.pdf
    • http://lojasamericanasbr.com/11517247805ctmfn.pdf
    • https://povijovo.weebly.com/uploads/1/3/4/4/134463476/5148296.pdf
    • https://static.s123-cdn-static.com/uploads/4413239/normal_5fdd3c6bbdc45.pdf
    • https://tizitumobupo.weebly.com/uploads/1/3/4/9/134904485/2a3767.pdf
    • https://cdn-cms.f-static.net/uploads/4417024/normal_5fd638cb0a51d.pdf
    • https://cdn-cms.f-static.net/uploads/4420745/normal_5fe7cf48cdfcd.pdf
    • https://lefoteliwe.weebly.com/uploads/1/3/4/0/134095852/fa5261b70fceca.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rebesudanolo/sujet_brevet_physique_chimie_pondichery_2019.pdf
    • https://s3.amazonaws.com/pasawe/fda_gadolinium_medication_guide.pdf
    • https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_5988cccdb88a4ef99d48acb9c22fc2a3.pdf?index=true
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_cc251e8a9a384fdd8208e64985fac8a2.pdf?index=true
    • https://2a403a33-5f6e-4534-96f9-742aa7325afc.filesusr.com/ugd/d2da83_1ddcb5cfbdf3416080642f8b9e614b50.pdf?index=true
    • https://uploads.strikinglycdn.com/files/953b8d12-4362-4b17-b6f9-850c65f09e10/79111524079.pdf
    • https://bfb79b04-db4d-4c54-a74a-4733ff68ceb9.filesusr.com/ugd/11291b_effe2c1b0ec241a296de687d2c4220ad.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a4d624ce-d562-452d-a519-4b0ef7741246/collins_the_language_of_god.pdf
    • https://61df3396-90b5-4b69-a3ae-475c9da6ebc5.filesusr.com/ugd/516574_739e52694a9d461cb63a261ce95f2050.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010542.bin
4490f15b195e859f6294a89d757cc56df09fa3ed189b945b3aa8d09dad7b79cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10542 5384 bytes
font_01_sfnt_off00011794.bin
2ba2019eb37432ac40771a562d2f5457ac174dc217c991d64ddf5168face28b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11794 10432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.