Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b8d62c8b6da4ada…

MALICIOUS

PDF

81.1 KB Created: 2021-03-21 10:41:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 71d3dec5846e16622342ba6c6c94666e SHA-1: 5f5c5d918b9b2f5de34cede9a9590159940469b5 SHA-256: 6b8d62c8b6da4ada4062ce613a7e6494cb32ace01e7fbb62cd973c664242485c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, and contains numerous external links, including a link farm heuristic. The embedded URLs, such as 'https://nipisod.ru/wix?keyword=canelo+vs+jacobs+free+live+stream+reddit', suggest a lure for live stream content, likely to facilitate phishing or malware delivery. The PDF structure and the presence of external links are indicative of a malicious document designed to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=canelo+vs+jacobs+free+live+stream+reddit
    • http://sexesex.site/26259289145kg6fe.pdf
    • https://cdn.sqhk.co/bodavadu/oRZ9tha/46823926781.pdf
    • https://cdn.sqhk.co/jotepomi/jiijeLx/10099736720.pdf
    • https://cdn.sqhk.co/fezavomol/ljcuON9/western_door_manufacturing_ltd.pdf
    • https://cdn.sqhk.co/kidatufo/1jaR2ic/puzzle_and_dragons_z_3ds_rom.pdf
    • http://tafiwon.mywebcommunity.org/60011034058.pdf
    • https://cdn.sqhk.co/zozimevoket/W5sghhd/10174298471.pdf
    • http://mpvideo.org/how_to_do_task_analysis06sdc.pdf
    • http://rijexofugovu.medianewsonline.com/what_are_reactive_strategies_in_aba.pdf
    • https://cdn.sqhk.co/tigoxexuda/jgdgcgc/40483028702.pdf
    • http://daravto18.ru/las_formas_elementales_de_la_vida_religiosa_durkheimcmjgr.pdf
    • http://pegijegur.mygamesonline.org/masunusufi.pdf
    • http://vereffka.xyz/science_a_closer_look_macmillan_mcgraw_hill_grade_3d340z.pdf
    • https://cdn.sqhk.co/lagolipumepi/ij6PmrE/beat_the_boss_smart_phone.pdf
    • https://cdn.sqhk.co/zarejesorufo/Bji14hd/real_airpods_2_cheap.pdf
    • https://cdn.sqhk.co/dikulodut/h6Wv7yV/43978709750.pdf
    • http://teenagetutor.online/77314039896dur0m.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_2d1e55bbba1b4f65851c433e4ecdb33f.pdf?index=true
    • https://ebed6276-6372-4ddf-adad-9a0fa504b99f.filesusr.com/ugd/805d2a_747245f6223243b9aaf4835fc94f0842.pdf?index=true
    • https://6d4a8fb0-9a8a-4850-8aa1-2b5706121c9a.filesusr.com/ugd/ff2e72_40ec06be3ac34c41b646488306b515ae.pdf?index=true
    • https://67258aaf-84c5-4a88-bfd2-1aa7ddb6c27a.filesusr.com/ugd/850f07_f08f44c483f741ad93340e30e4317479.pdf?index=true
    • https://391e4f24-9fc9-4707-ac06-338edcd9f959.filesusr.com/ugd/110ef3_500475320ca945c1976c63136fda52e9.pdf?index=true
    • https://5849b288-062f-49f8-a71b-da420f1f00fd.filesusr.com/ugd/c068f8_60a6b38434f74ec5a5a5afa3773b244e.pdf?index=true
    • https://62abf401-5fc9-4991-ac00-cb6a0c8cf8ec.filesusr.com/ugd/e4ff69_900f6f2225f24effaf9dc854df79984e.pdf?index=true
    • http://desigaweru.myartsonline.com/anthropogenic_activities_and_their_impacts_on_environment.pdf
    • https://7fd92c66-d3af-485c-b7a9-31529ddfb1b5.filesusr.com/ugd/997d0f_92f70fa416fb4f77b88560ca160338ec.pdf?index=true
    • https://ebc1add8-0b9d-418e-9e4a-1e287827e933.filesusr.com/ugd/ab63e3_b7351cb6113a443981c8b03ba728c162.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc58.bin
d15db202b9d759d5fc694cc5ce586867d74aff9076747e6354d5cc13bfc6b03c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC58 5348 bytes
font_01_sfnt_off00010e78.bin
efafaf2eb49a2afc6fe1f0e9a23d14c7f013b651faa1e2bc9fe6f3dabd4ed063		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E78 12136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.