Malicious PDF — malware analysis report

Static analysis result for SHA-256 7077f6c0b86ce137…

MALICIOUS

PDF

80.5 KB Created: 2021-04-07 18:32:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 13dca79ed402e5b30507964493247669 SHA-1: 184a3d2f475a9289c2511e4ccd0dcd1dee68e902 SHA-256: 7077f6c0b86ce1378942aed1b54887e56ae4cf3bf586a625af46d9074c079316
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. One prominent URL, https://dugedepap.ru/strik?utm_term=what+does+it+mean+when+your+boyfriend+winks+at+you, is presented as an article title, likely to entice clicks. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=what+does+it+mean+when+your+boyfriend+winks+at+you
    • https://cdn.sqhk.co/lajawawinu/gc4Yhgk/nail_biting_causing_infection.pdf
    • https://cdn.sqhk.co/bafiweba/jfihjbV/hockey_goal_horn.pdf
    • https://cdn-cms.f-static.net/uploads/4454043/normal_603a2c78d769b.pdf
    • https://cdn-cms.f-static.net/uploads/4465255/normal_60342f9081ec3.pdf
    • https://cdn.sqhk.co/komajekolino/b0eohgc/37034589580.pdf
    • https://cdn-cms.f-static.net/uploads/4379848/normal_604ccb2c48cb8.pdf
    • https://cdn.sqhk.co/wesuwajil/fje3Fam/kiduwemoveraxisivifona.pdf
    • http://legivupipofu.66ghz.com/wi_ccap_court_forms.pdf
    • http://revinulamuxawa.22web.org/assignment_front_page_design.pdf
    • https://static.s123-cdn-static.com/uploads/4411686/normal_5fde68df35a64.pdf
    • http://xusatijugezi.iblogger.org/94855078136.pdf
    • https://static.s123-cdn-static.com/uploads/4387815/normal_6001104eb1b4d.pdf
    • https://cdn-cms.f-static.net/uploads/4377925/normal_6046966ef06cd.pdf
    • https://cdn-cms.f-static.net/uploads/4501042/normal_604cbf0c3ec28.pdf
    • https://cdn-cms.f-static.net/uploads/4486346/normal_600ec1a4de9e7.pdf
    • https://cdn-cms.f-static.net/uploads/4467573/normal_6015be18e83d4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wulumesa.epizy.com/paduvedek.pdf
    • https://584abdf6-e408-48d3-a53c-4313a8f82471.filesusr.com/ugd/18ee90_50b3239f746d4f39962c0c0a37748331.pdf?index=true
    • https://a97be2a3-bfb5-42de-bba9-b145341b31aa.filesusr.com/ugd/1f2860_3fed2344522249a5bb4b28f513ce034d.pdf?index=true
    • http://pajinofemi.epizy.com/bazesafo.pdf
    • https://dfa52777-3edb-460f-9b14-ca5101cd4ecc.filesusr.com/ugd/5360f8_d46c02d7757f40fda48125ed7d314b2b.pdf?index=true
    • http://pefijolal.rf.gd/principles_of_physics_halliday_resnick_walker_10th_edition.pdf
    • http://logururud.epizy.com/green_eyed_lady_sheet_music.pdf
    • http://mifevup.rf.gd/oscar_award_2020_in_tamil.pdf
    • https://5e446c31-fcb6-4427-a178-91ee45bbff8b.filesusr.com/ugd/4e76b8_0ff24a23fab94c45b405466b4e50b3a4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb34.bin
bafc1177e5f92cc7e4a586c38fe09e290268399de67c98f4cff3981e3cc4da26		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB34 5524 bytes
font_01_sfnt_off00010dee.bin
5d91967de7a0559a316acfc39a2e47bab1bfacdc2791c4cef2b17fa01821e52e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DEE 10616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.