Malicious PDF — malware analysis report

Static analysis result for SHA-256 6647b0bd06938956…

MALICIOUS

PDF

78.6 KB Created: 2021-03-22 09:11:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 33f88396c535e3f0a92034b075117b6b SHA-1: 7a5797afdd1fa192c708e2ad3938a5c4745c98e1 SHA-256: 6647b0bd0693895684f3f2acd1605757668d295221c0ab7aabc3333a95cfcc99
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are to PDF files, suggesting a link farm or redirection mechanism. One of the embedded URLs, https://lozipotod.ru/123?utm_term=vidmate+install++9apps, is suspicious and likely serves as a lure for downloading malware, possibly related to the 'vidmate install' search term. The presence of a 'download button' heuristic further supports the lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=vidmate+install++9apps
    • http://feboxazatoran.22web.org/acute_heart_failure_syndromes.pdf
    • http://posiriwase.22web.org/766448192.pdf
    • http://netezasodi.22web.org/16201687389.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kavolimuteso.epizy.com/20171084319.pdf
    • https://uploads.strikinglycdn.com/files/9996afe2-c60d-4192-94da-63f84686ae05/angles_in_triangles_worksheets.pdf
    • http://bavuveba.epizy.com/information_theory_course.pdf
    • https://76c9fb28-c10e-4950-85be-37de24a2ede8.filesusr.com/ugd/fa32a6_3a9e9be611424bd1b2cc8f9ff2db706f.pdf?index=true
    • https://52431b39-7396-4b0c-bcaf-ab72d449a1bf.filesusr.com/ugd/f8cef3_fd336843a9d0453b84c0823326ced371.pdf?index=true
    • http://duxepivol.myartsonline.com/the_egypt_game_summary_chapter_6.pdf
    • https://f9c81679-ddb1-4746-ab40-32673edc426c.filesusr.com/ugd/2eff39_6e7713ec49db4d10951acb3431f53278.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4c475192-d9d8-4cd1-b7ea-8c71e328ef8b/kivodexuvabi.pdf
    • https://uploads.strikinglycdn.com/files/846db21e-4488-4aac-8c2b-83346efb9bd5/football_manager_handheld_2021_apk.pdf
    • https://uploads.strikinglycdn.com/files/7ef53dcd-9260-4750-a6e3-0aeec7facfdd/brandon_burlsworth_locker_today.pdf
    • http://robatirewixiwol.rf.gd/how_to_change_the_time_on_esi-dex_phone.pdf
    • https://uploads.strikinglycdn.com/files/d46ebc7d-3959-43ad-a1ea-6390a91499b3/best_ponniyin_selvan_audio_book.pdf
    • https://044e8d80-c429-4a1f-820d-9b443c65b389.filesusr.com/ugd/53c654_3e4582455ed544f4b47c8980001869f0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/12be1838-040f-4b93-8e01-537369690650/how_to_read_like_a_writer_mike_bunn.pdf
    • https://uploads.strikinglycdn.com/files/e2f52a66-10ef-48f4-8b53-f6c055c5f156/jajurejanoka.pdf
    • http://sujidise.epizy.com/kodiak_island_bear_hunting_guide.pdf
    • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_52cd08b5c139482b9b77366b0d6814f8.pdf?index=true
    • http://tirisesu.onlinewebshop.net/20571388338.pdf
    • http://ledaruwevegoxu.onlinewebshop.net/mitimeveguvevudivoka.pdf
    • https://uploads.strikinglycdn.com/files/37498aef-ed13-4fb4-a5c9-d2bdfac349dd/how_many_different_crochet_stitches_are_there.pdf
    • https://uploads.strikinglycdn.com/files/b8b5c60f-01b6-4616-9f9d-d4bae36e6ea9/nutrition_info_for_taco_bell_crunchwrap_supreme.pdf
    • http://robogotut.epizy.com/82050553791.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f641.bin
84b704a12d3014d6208bfd21078bc6d2bc1c096a3c50dc1cc3e4e220c9deba28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF641 5128 bytes
font_01_sfnt_off0001079f.bin
d0d5c18b5a2ae1a1ef1562f6e6ed197e659e948db4b3e0fbcc987d5a7e02cbf6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1079F 10928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.