Malicious PDF — malware analysis report

Static analysis result for SHA-256 649e1d299206004c…

MALICIOUS

PDF

84.1 KB Created: 2021-03-16 20:17:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 34a91e16e33438be92921f57ab369624 SHA-1: 43eadc97667025697a0d2e8201ac2c4e371f2750 SHA-256: 649e1d299206004c7c607d6b39fcd6201f3008cf36cb511994259ec01e9a5506
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary URLs, 'https://jumiwimov.ru/strik?utm_term=has+the+bronze+horseman+been+made+into+a+movie', is suspicious and likely leads to malicious content. The ClamAV detection and ML classifier also indicate maliciousness, suggesting this is a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=has+the+bronze+horseman+been+made+into+a+movie
    • http://tiktokfrance.fun/rhetorical_strategies_ap_lang_essayogko4.pdf
    • https://cdn.sqhk.co/rogudokives/bgjZigx/video_maker_for_youtube_apk_mod.pdf
    • https://cdn.sqhk.co/sarodeduz/kcCXiby/carboxylic_acid_notes.pdf
    • https://cdn.sqhk.co/nimuxugemu/hiiagcI/rogixanawurefes.pdf
    • http://sawumivulopajud.22web.org/pabobudiruxotilutitoxiki.pdf
    • http://zoneeuro.pro/man_myth_and_magic_an_illustrated_eniue5x.pdf
    • http://rofadiv.iblogger.org/ginejuvupazut.pdf
    • https://cdn.sqhk.co/vunofufi/F6phedQ/nawegumigemuroku.pdf
    • https://cdn.sqhk.co/tefulobesa/6xG3Ohb/hard_rock_radio_stations_nyc.pdf
    • https://cdn.sqhk.co/niserutom/teWjfjh/928519882.pdf
    • http://lafafojazepu.22web.org/caballo_de_troya_verdad_o_mentira.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/dc8ab74b-a5d3-47b6-a705-0a8d7c7a160f/xadaxe.pdf
    • https://da9d63b4-fbfd-4f6f-88e7-06ac0d76355b.filesusr.com/ugd/ca300b_63481b79d1454887849a66f19c3f4763.pdf?index=true
    • https://9042e326-c85f-44e6-b9b6-0c206471fdba.filesusr.com/ugd/0d2fda_9319dfd57077423ca9efea7ac10c0ad9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a153352c-609c-457d-b977-a55cd4038484/32401877701.pdf
    • https://01d67eed-50ba-4ccb-8f82-c1581f7ed07e.filesusr.com/ugd/e3325f_0e966ca36d154f3781a9e6d2408842b6.pdf?index=true
    • https://8909b315-4d59-4940-aabf-0fdaa532e0ad.filesusr.com/ugd/4542d9_29ecebff5ef84b128ee3f8506ffa0f19.pdf?index=true
    • https://uploads.strikinglycdn.com/files/114b4c3b-f9f0-4d87-ab1e-cd31979725b0/juximijameliv.pdf
    • https://uploads.strikinglycdn.com/files/3849aaab-5dd4-44fd-a7f7-f49a36a7fc84/lapagudoman.pdf
    • https://uploads.strikinglycdn.com/files/2f6b79b1-02dc-4a2d-9f3b-8ad5642c63d5/webasto_diesel_water_heater_problems.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010720.bin
fccc744b179d33cdcc4c8590326acf1b256d038bb0a098ef2a15c10278d14170		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10720 5244 bytes
font_01_sfnt_off000118cb.bin
b62d2b5186162de3f6d2319c95f55eeb04d484ed9eb68eb01323ff428c6281c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118CB 11860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.