Malicious PDF — malware analysis report

Static analysis result for SHA-256 7107e77202d6f837…

MALICIOUS

PDF

82.2 KB Created: 2021-04-17 01:44:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 28a8855073a249bbeb8e413ae442792d SHA-1: 28af0ffe08f0a8c2caf02ad4cde8195f934bd702 SHA-256: 7107e77202d6f83737e9979b2af0f88eeeb99cb77d7eb76efa4e9030a72d7938
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains numerous external links, characteristic of a link farm or phishing lure, with one prominent URL pointing to 'lozipotod.ru'. The 'SE_CLICKFIX' heuristic indicates the document likely instructs users to execute commands, a common social engineering tactic. ClamAV detection and ML classification confirm its malicious nature, suggesting it's a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=realtek+hd+audio+manager+not+in+control+panel+windows+10
    • http://dezlice.ru/easy_piano_love_songs_sheet_music_freerfpfu.pdf
    • https://cdn.sqhk.co/mebereserab/TIigjdt/o_que__movimento_uniformemente_retardado.pdf
    • http://helpcopyright-service.com/stock_market_gamestop_robinhoodbtjje.pdf
    • https://cdn.sqhk.co/xikesurufa/VXifZjf/dirty_charades_game_online.pdf
    • https://cdn.sqhk.co/sesekopusoj/fhjzI8g/fiwutujamuvaxobib.pdf
    • https://sivevaredewiw.weebly.com/uploads/1/3/4/4/134464028/8104783.pdf
    • http://lngcliente.com/baby_boy_and_girl_imagesnrioq.pdf
    • https://cdn.sqhk.co/gojikanemiju/ehb3Hic/22202740217.pdf
    • http://triple-doska3.club/62069654366n4z52.pdf
    • https://fuvedomuwipiw.weebly.com/uploads/1/3/1/6/131636935/xeguxijizi_nomofulunop_mozuw_guluwuboxuwalak.pdf
    • https://cdn.sqhk.co/fomeluxilim/vrHshcX/games_online_free_no_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/zamemigojat/xosarafapowileto.pdf
    • https://s3.amazonaws.com/bodajaku/kia_cerato_2005_service_manual.pdf
    • https://s3.amazonaws.com/bezegoluzose/96790556238.pdf
    • https://s3.amazonaws.com/baxekojojexusol/19947929557.pdf
    • https://s3.amazonaws.com/paxuvagal/which_receptor_is_used_to_sense_the_taste_of_food.pdf
    • https://s3.amazonaws.com/tetofamuxulil/ignou_ba_philosophy_study_material_in_hindi.pdf
    • https://ce5d016b-e5fb-4004-af8f-35f61b829e22.filesusr.com/ugd/d7d7f8_bbf4fa28637c440f8e6543cea4485ae0.pdf?index=true
    • https://s3.amazonaws.com/lulelepese/66505591139.pdf
    • https://s3.amazonaws.com/rogugagatuf/xolenilurudonogafemep.pdf
    • https://s3.amazonaws.com/fezenur/61287313554.pdf
    • https://a0bbd489-bf03-48a0-8e93-88abd0751e5b.filesusr.com/ugd/370ea2_f91993d591ff4d3384d230e804a6512c.pdf?index=true
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_1c8cb2864ef2435797e2c68fc4f203b7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1df.bin
3a6f7f9612bbe136815c354837932adf49644eb4e69496aff1f44d37a972a02c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1DF 5724 bytes
font_01_sfnt_off00010546.bin
0b2fa309f4ff5237b3651d4b2091992a57800b19616a6fdc735385e608be6f96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10546 11068 bytes
font_02_sfnt_off00012af7.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AF7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.