Malicious PDF — malware analysis report

Static analysis result for SHA-256 73edbce8c5b0ce17…

MALICIOUS

PDF

79.5 KB Created: 2021-03-14 22:52:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d56b1fb922f6f2976dcce0e80d255c39 SHA-1: 01773e5a93928af3474486407f5653622ef686d9 SHA-256: 73edbce8c5b0ce173dce82d6feab255f2037f4b8c5be1a717942072cadae32bc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying a 'PDF_SEO_LINK_FARM' pointing to multiple PDF files hosted on suspicious domains. The ML classifier and ClamAV also flagged this PDF as malicious, specifically as a phishing or trojan variant. The embedded URL 'https://lozipotod.ru/123?utm_term=apple+tv+app++movies' suggests a lure related to Apple TV movies, likely to trick users into visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=apple+tv+app++movies
    • http://mupixejida.22web.org/32558672421.pdf
    • https://cdn.sqhk.co/fekepazerox/8ha7idH/economics_degree_jobs_chicago.pdf
    • http://merogerofame.66ghz.com/vagebelukusuzun.pdf
    • https://zutomivopisi.weebly.com/uploads/1/3/6/0/136051870/f289224e2d6fd.pdf
    • https://dexidete.weebly.com/uploads/1/3/5/3/135394420/jotetuwonux-vuviwozawun-wuriwalibafine-pewamuzetoku.pdf
    • https://cdn.sqhk.co/ritasuxa/dQjihjp/webalefiv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/f0abc1c4-8189-4483-b1df-6d0e7610570c/63384874339.pdf
    • https://uploads.strikinglycdn.com/files/d6b3714e-429b-420b-b891-3a719e24874e/xigazifegupatid.pdf
    • https://uploads.strikinglycdn.com/files/b99e9e45-9847-4d83-9ccb-c4ef7ec3af06/que_es_un_problema_de_investigacion_ejemplos.pdf
    • http://zuxorijafofonal.rf.gd/pejimifiwotelasaro.pdf
    • https://uploads.strikinglycdn.com/files/92c9cc9a-ef4f-49e2-9942-cc5389e2ad18/22702797728.pdf
    • https://13fad4bf-7224-44b3-802b-16842e97d241.filesusr.com/ugd/b14664_b660d82d16224b3fbe7894539010a742.pdf?index=true
    • https://uploads.strikinglycdn.com/files/79b9d9d0-0796-4c12-95d3-c48d09052df7/what_is_pre_surgery_clearance.pdf
    • https://uploads.strikinglycdn.com/files/dd3b7a37-88a4-4bd2-9173-4e82c416ebcd/how_to_calculate_cash_flow_ratio.pdf
    • https://443275ec-395d-4f86-84c9-2ed7a250e117.filesusr.com/ugd/7d471d_2a32fffd6b2d4c75af13266ee125dd66.pdf?index=true
    • https://uploads.strikinglycdn.com/files/deb4c5d9-41a2-499f-9467-3d6316e09ce2/is_ruger_10_22_takedown_worth_it.pdf
    • https://b7e73dfe-ad35-4791-b4f7-7500f5b7882c.filesusr.com/ugd/bc79a4_2ddb17834a3f4169a83ba29b40cd916c.pdf?index=true
    • http://fuxatigapisi.epizy.com/neriwojanafag.pdf
    • https://uploads.strikinglycdn.com/files/a94a7e95-89bc-4644-baeb-46b688aff1b6/how_to_change_the_code_on_a_schlage_model_fe595.pdf
    • https://661c91a2-68a2-4ae3-aaac-ef96b6cc7894.filesusr.com/ugd/b926a8_e45e208bfc4347ca8b206db27034cdcd.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ede3.bin
91d175844c0537b88dfb400d518eb51e883afd3fbe9c259c286a479e8a1ce071		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDE3 4600 bytes
font_01_sfnt_off0000fd8a.bin
09a73f01bf270563c184cb9cf90dd6e7e0f705d2562fbc0a84c7114cd6239a64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD8A 11000 bytes
font_02_sfnt_off00012318.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12318 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.