Malicious PDF — malware analysis report

Static analysis result for SHA-256 79f4198b41538f8e…

MALICIOUS

PDF

84.1 KB Created: 2021-05-10 15:22:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bcb3547830e3f050278c09eab53bea5a SHA-1: 8452044a08f0643d2c5d92dfa8efc3730b012699 SHA-256: 79f4198b41538f8e171ed77dc64f1f5e3d4cb5dc1c63c61c61758c951052ad46
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for phishing or redirecting users to malicious sites. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing. The embedded URL points to a domain associated with malicious activity, likely serving as a landing page for further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+convert+micro+sim+card+into+nano+sim+card
    • https://cdn-cms.f-static.net/uploads/4414678/normal_606432bfeba39.pdf
    • https://seporarutigofu.weebly.com/uploads/1/3/2/7/132741198/7eef695f8b1a8e3.pdf
    • https://vukosigubew.weebly.com/uploads/1/3/4/8/134860762/01eedbd039a7718.pdf
    • https://cdn-cms.f-static.net/uploads/4373511/normal_60612fe17a8e4.pdf
    • https://noduxulab.weebly.com/uploads/1/3/4/9/134901810/vepekusu_zuzagev_zibose_zutaxulu.pdf
    • https://welogodeketi.weebly.com/uploads/1/3/5/3/135326703/4894.pdf
    • https://pigukoziluluz.weebly.com/uploads/1/3/4/8/134896600/wepepokarugow_pugejita_tazuno.pdf
    • https://nijolajosota.weebly.com/uploads/1/3/4/6/134678148/d93a1ab46788.pdf
    • https://cdn-cms.f-static.net/uploads/4500200/normal_606cd7b41e9be.pdf
    • https://vekukedabil.weebly.com/uploads/1/3/4/7/134710008/e76d5b609740c5.pdf
    • https://cdn-cms.f-static.net/uploads/4460042/normal_606399b089e6b.pdf
    • https://fofosefekilom.weebly.com/uploads/1/3/0/8/130813764/98d19fa.pdf
    • https://cdn-cms.f-static.net/uploads/4423750/normal_60563aabad1ef.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/21f5784f-6a24-4f20-99c4-f67759646c6a/nagapuwaku.pdf
    • https://6ae5a9c1-8526-45f7-b068-03ddf2465b28.filesusr.com/ugd/87f732_03aeed063cd940f1a745ce6578e803b8.pdf?index=true
    • https://01ff271a-2d66-4e22-ac0f-a796646d2f56.filesusr.com/ugd/8d93e9_b2568d352637432795d7fef7282ee1ee.pdf?index=true
    • https://2acf176d-1645-44e4-83be-c67f7ac9af6b.filesusr.com/ugd/e72dd6_ca92904377034dde87208b30792c02c9.pdf?index=true
    • https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_d69ed267dcb24d6c914fd31ceaca8797.pdf?index=true
    • https://e53c8fcc-339b-4d8f-83f6-44ddc8c6ace4.filesusr.com/ugd/1ea9c4_c753092a83b04a17a92a0559c56e3e04.pdf?index=true
    • https://9cc02d22-446e-415d-9686-6e49aadcb3b3.filesusr.com/ugd/aa6a08_0750aefaa73e4df0a4b2396618049e3e.pdf?index=true
    • https://f33d1b56-f518-462b-b61f-c1b5c1ba661c.filesusr.com/ugd/1c44ce_3d0dbb163eae4a78a91dececc1f19897.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e833f493-fb0f-4e49-a57f-50ff4ba8ef06/self_isolation_before_surgery_ireland.pdf
    • https://uploads.strikinglycdn.com/files/9b4b405a-bbaf-48d1-84ac-e1a069b0d41d/onkyo_ht-r500_specs.pdf
    • https://201a0bc5-0eb3-4135-8969-828875a6b07d.filesusr.com/ugd/607883_c6eaeaf32b70408fb1ebef240cc80952.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fec5.bin
c1bc3610f04683b0fb9987c8da012f3335e6f52fc9780cac6305ff08bf2c69d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEC5 4956 bytes
font_01_sfnt_off00010f85.bin
612e1ad4e5afe965edd904d939919c1ef7b6274bc49f2325df9096b43e117d3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F85 10648 bytes
font_02_sfnt_off00013408.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13408 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.