Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b85694caedfcaac…

MALICIOUS

PDF

74.2 KB Created: 2021-04-03 21:47:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a76a0765aa6776e115d6b72acb7f7fde SHA-1: 767480e44d9d3151184248a1f73c57c71760c598 SHA-256: 7b85694caedfcaacfc13689a60a85793f8530c53a0ba108dd66a3e0bcdcd7e86
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, a technique commonly used in SEO link farms and phishing campaigns. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary malicious URL identified is https://resalured.ru/strik?utm_term=fronius+ig+plus+reset, which likely serves as a lure to a phishing page or a malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=fronius+ig+plus+reset
    • http://wuzubofetaxoger.iblogger.org/26159473670.pdf
    • https://sizelelam.weebly.com/uploads/1/3/4/8/134867910/bedumelozabefuturuz.pdf
    • https://vokanuxuvewelar.weebly.com/uploads/1/3/4/6/134618840/mefefafazemi-vifawoxuwutan.pdf
    • https://cdn-cms.f-static.net/uploads/4368972/normal_6039f97b4f4e3.pdf
    • https://cdn-cms.f-static.net/uploads/4379379/normal_6028e98c4e398.pdf
    • https://rejejowurodesom.weebly.com/uploads/1/3/1/3/131398559/3140254.pdf
    • https://cdn-cms.f-static.net/uploads/4448724/normal_601480d208189.pdf
    • https://jepuderakemuso.weebly.com/uploads/1/3/4/6/134666912/wodepavarifirifawelu.pdf
    • https://tumizoma.weebly.com/uploads/1/3/2/8/132814974/pilusiwuwasimeruv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_fa8dccdaae914f6abd0dd2e9655ed4e9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/95fcc600-2e9d-4de5-a7eb-37b7a7348d0e/heinnie_haynes_discount_code.pdf
    • http://zewixezix.epizy.com/kawasukumedixilesu.pdf
    • https://uploads.strikinglycdn.com/files/e6a738e3-e130-4f7f-bda5-27075ade37c4/zabumeko.pdf
    • http://jatuvujuf.epizy.com/vodibajezab.pdf
    • https://uploads.strikinglycdn.com/files/80e72f66-43db-47f5-ac0f-869f6a089c93/6524999891.pdf
    • https://uploads.strikinglycdn.com/files/90dad37b-0a8d-4850-9839-83be9b1daf26/mary_poppins_returns_cast_julie_andrews.pdf
    • http://nemunuj.rf.gd/chaalbaaz_movie_hd_video.pdf
    • https://uploads.strikinglycdn.com/files/ffb732e5-1114-457b-9ed7-ed44946e912d/zibeviworowoda.pdf
    • https://uploads.strikinglycdn.com/files/512127dc-b6a0-4e90-9905-eaf2ab2a1942/pisedosikinigob.pdf
    • https://uploads.strikinglycdn.com/files/5408d15c-8ec6-46a6-9e17-4191250d3bf1/modo_de_produccion_capitalista.pdf
    • https://uploads.strikinglycdn.com/files/bb98aa51-9e0a-40c7-8ba2-89273bcca8f5/zasof.pdf
    • https://uploads.strikinglycdn.com/files/4695fac8-1614-4a05-81f9-22da25c56a48/69420868313.pdf
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_0cc90685dbdd43b980c303f573907863.pdf?index=true
    • https://b7f5b04e-b247-49a4-9dc0-39f0c843ec09.filesusr.com/ugd/b56f86_7bfea15814624059b65c61756c966d87.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8b635a0b-7eaf-4943-a5c1-e7f6734dd7bf/54188395035.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7c1.bin
282018d32d78189c13df25ae4f2926453dbb8055f30444cdbb59a971959a4cc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7C1 4732 bytes
font_01_sfnt_off0000f7f3.bin
bf08667bd2f12e4a9d9b247600c400c2b009a569b8c385810ea1ad05299d5cc0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7F3 10548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.