Malicious PDF — malware analysis report

Static analysis result for SHA-256 6400735f7ea2d120…

MALICIOUS

PDF

77.9 KB Created: 2021-03-30 13:39:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 916d8f3529f6803ef65c6b74ece9791f SHA-1: 82aa5d6b4b3e00492b182b73412fe278b344d3a6 SHA-256: 6400735f7ea2d120d765643f179cfd2a1eae9384a849cc8cf37c0b2376b44622
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file was identified as malicious by ClamAV and an ML classifier, with heuristics indicating it contains a link farm of external URIs. The primary malicious URL identified is 'https://gimoguvi.ru/wix?keyword=cool+math+games+moto+x3m+3+unblocked', which is likely used to distribute further payloads or conduct phishing. The presence of PDF-specific heuristics suggests exploitation of PDF vulnerabilities for client execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/wix?keyword=cool+math+games+moto+x3m+3+unblocked
    • https://nolaxefipox.weebly.com/uploads/1/3/4/7/134740184/nudiruv-zobit-dozebunukut.pdf
    • https://cdn-cms.f-static.net/uploads/4451941/normal_602bb0e0e758f.pdf
    • http://tazizinujumijoj.mywebcommunity.org/accounting_rate_of_return_problems_and_solutions.pdf
    • https://sizadefo.weebly.com/uploads/1/3/4/3/134381744/8465939.pdf
    • https://noloxuxema.weebly.com/uploads/1/3/1/4/131453633/lebavasejopovag.pdf
    • https://static.s123-cdn-static.com/uploads/4380890/normal_5fc87ddfb52f0.pdf
    • https://degubazof.weebly.com/uploads/1/3/5/3/135304991/wuvakewuriranimeb.pdf
    • https://cdn.sqhk.co/lelabepena/hjsr0jb/manememiluxoxobira.pdf
    • https://cdn.sqhk.co/gepelarawazu/2gfnhqf/6594998998.pdf
    • https://cdn-cms.f-static.net/uploads/4464530/normal_602148af5043b.pdf
    • https://sikiroradimer.weebly.com/uploads/1/3/4/6/134619363/5577c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1f2617f4-84bf-4ab7-9615-1a6b478c4c82/20858043404.pdf
    • https://uploads.strikinglycdn.com/files/94f75ed7-96c7-432d-b898-1efb41e08e4d/longman_dictionary_of_contemporary_english_5th_edition_full_apk.pdf
    • http://sajomapujozokux.onlinewebshop.net/24582207115.pdf
    • https://uploads.strikinglycdn.com/files/a52037e0-c578-40fd-91bb-4cb3820cbb87/32318050533.pdf
    • https://uploads.strikinglycdn.com/files/241cc884-abec-407b-83b0-576c664652bf/letofefelogixokakite.pdf
    • https://uploads.strikinglycdn.com/files/623ef431-c47e-4c40-894a-7a54dc27b2c7/lodaluf.pdf
    • https://uploads.strikinglycdn.com/files/b7a17c3f-b024-4935-bbf7-1e5a18f1d933/77870011270.pdf
    • https://uploads.strikinglycdn.com/files/3d2f2f50-58af-476e-9dc6-78c702215ed3/35845068368.pdf
    • https://uploads.strikinglycdn.com/files/3cb90f4f-2d81-4b2a-8675-b8f321b8cf58/52235938816.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f497.bin
23f8d025b58a20f123258bbac2632efd22f5a51e6467dd7f93e5cbd656eb1d78		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF497 5596 bytes
font_01_sfnt_off00010772.bin
f97d6311620e9d48cb4c0406117f69f2706094b49d6f2febb17d559cc0a11556		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10772 10336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.