Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b8c32722608a8e3…

MALICIOUS

PDF

72.9 KB Created: 2021-03-14 10:47:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4b3fa2a01380b72bd2754bbfb604548 SHA-1: 1bcf4491967623ef37e4a0efacd4a4bca1e29c89 SHA-256: 7b8c32722608a8e38058328a7c46e875b750cdff7e63e1238ac6ace0fc645dac
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm pointing to 30 external PDF documents. The primary malicious URLs identified are 'https://lozipotod.ru/award?keyword=adverb+exercises+for+class+6+pdf' and 'http://mivetys.xyz/romebavinusoxiwigefiwrh8.pdf', suggesting a phishing or SEO spam campaign. ClamAV detection and ML classification further confirm its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=adverb+exercises+for+class+6+pdf
    • http://mivetys.xyz/romebavinusoxiwigefiwrh8.pdf
    • https://cdn-cms.f-static.net/uploads/4380380/normal_6032cfc1c492b.pdf
    • http://creditstar-kabinet.com/charting_outcomes_2019_osteopathicadx6w.pdf
    • http://afracheat4.xyz/929716792310xths.pdf
    • https://cdn-cms.f-static.net/uploads/4445343/normal_5fe7743b9d34c.pdf
    • https://static.s123-cdn-static.com/uploads/4485296/normal_5fcef613c6ee8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gawabog/hp_laserjet_pro_p1102_laser_printer_-_monochrome.pdf
    • https://s3.amazonaws.com/mixanaz/mugesokenin.pdf
    • https://s3.amazonaws.com/vebogotexaf/zaxenonuvemawomaripavu.pdf
    • https://b5b764bc-4fc6-48d7-9a4b-423a4d05f225.filesusr.com/ugd/3f2390_27c194284db244c1bcfdd83f767e1c9f.pdf?index=true
    • https://s3.amazonaws.com/zumezeviwakiz/narukuzukawaf.pdf
    • https://uploads.strikinglycdn.com/files/3c1a483b-05a8-46b7-846a-223d02f1b4d0/15742530275.pdf
    • https://s3.amazonaws.com/tugabijenovili/wings_of_fire_the_dragonet_prophecy_audiobook.pdf
    • https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_8e80e4e26ee946e6bfe67cf4e5ac5d21.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2dd50436-ee81-4bba-ae6b-f863e6dda2a5/82290166070.pdf
    • https://uploads.strikinglycdn.com/files/41201e52-4f4b-4ffa-b357-c99d7627a009/kuvolulobese.pdf
    • https://uploads.strikinglycdn.com/files/c895c3dd-9ebb-4a65-854b-a11f85149576/dungeons__dragons_monster_manual_5th_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de0b.bin
2ad4bb472a8593cb414bae18fc3a6ba48ac772af8a3390d469dfdc2d5a18aa06		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE0B 5560 bytes
font_01_sfnt_off0000f10b.bin
1d3866f29881cdf4475d3dcf6a77c8ddb5e21d2efd4119d2286fe86a266281be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF10B 11268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.