Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ec6115aaf71449a…

MALICIOUS

PDF

82.4 KB Created: 2021-06-07 03:01:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b3ae7b3181ebdcc32868e0d23f598cef SHA-1: 11d9b4a672189d186f718f2d3cf18ebc935f938c SHA-256: 7ec6115aaf71449a9c4e70ec5cf74379a29022a84353a99e3d997d17dfeca830
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, with the primary URL being 'https://pistant.ru/pbw?utm_term=which+event+triggered+world+war+ii+brainly'. The heuristic 'PDF_SEO_LINK_FARM' suggests the document's purpose is to generate traffic or distribute further malicious content through a mass of external links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/pbw?utm_term=which+event+triggered+world+war+ii+brainly
    • https://sokimazivad.weebly.com/uploads/1/3/4/6/134620474/boxipegasadeb-dowatifadime.pdf
    • https://moxudula.weebly.com/uploads/1/3/4/8/134884970/xapewipabuwuvuxar.pdf
    • https://zidimegaga.weebly.com/uploads/1/3/0/9/130969389/sumutevugoguzin.pdf
    • https://sunerewej.weebly.com/uploads/1/3/4/7/134724547/zaniluwaximis.pdf
    • https://takupomowemeb.weebly.com/uploads/1/3/5/3/135314116/meberezozat-bejujod-murijex-gelamavivu.pdf
    • https://ximofutaxa.weebly.com/uploads/1/3/4/6/134626718/pikopi.pdf
    • https://gatofofuxiwiv.weebly.com/uploads/1/3/4/2/134265530/1158daf.pdf
    • https://xufujakuzizam.weebly.com/uploads/1/3/5/3/135315974/777f41ee1e9c.pdf
    • https://silolezozuwagu.weebly.com/uploads/1/3/0/7/130774999/ba30a0ad.pdf
    • https://juloxiwam.weebly.com/uploads/1/3/5/9/135967800/947055.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/459f038c-00be-4671-a6d0-8f297fcae8de/pain_makes_me_feel_alive_quotes.pdf
    • https://uploads.strikinglycdn.com/files/eba58493-cca1-42de-b339-c5c8cb3eefed/72100820559.pdf
    • https://uploads.strikinglycdn.com/files/de291b4d-1e45-4426-89f3-5a5c7eb870d2/somexevutupapumasuseponon.pdf
    • http://fisukafetif.pbworks.com/w/file/fetch/144424986/tajutubufizadizojinokin.pdf
    • http://lulatigono.pbworks.com/w/file/fetch/144550752/supuzivab.pdf
    • https://uploads.strikinglycdn.com/files/6304698f-d4e0-437d-8daf-87c8e2ca80f8/xupugifovixiselus.pdf
    • https://uploads.strikinglycdn.com/files/b2fc8d29-29e2-4760-8e9c-c99cdcbd885f/27760989633.pdf
    • https://uploads.strikinglycdn.com/files/977ad3f6-7ab7-4579-a24c-1497cafc0033/diripotakoferelaxad.pdf
    • https://uploads.strikinglycdn.com/files/2732f6a3-857f-4e85-b4ca-6fc8bdf002ad/79222174700.pdf
    • http://tasonupopam.pbworks.com/f/how_to_write_application_for_mistake_in_form.pdf
    • http://demopefo.pbworks.com/f/gta_5_mobile_apk__data_free_download.pdf
    • http://sujabuno.pbworks.com/w/file/fetch/144732549/1998_bayliner_2452_ciera_express_reviews.pdf
    • https://uploads.strikinglycdn.com/files/749c6828-bb7c-46bc-ab1c-59adafb9f359/16895732802.pdf
    • https://uploads.strikinglycdn.com/files/5e4ede8f-843e-4a01-9880-8c2d05890f48/wuvikimew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8db.bin
6e22e3427cbb8675814bde329fdb625a4b7b1d959fd6b666710062607e7bf8d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8DB 5216 bytes
font_01_sfnt_off00010aa0.bin
0d8c0d21a2b8c2fcad962fabb04b52a8a12b62bbc6e9ab7ee5e8df99807518bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA0 10412 bytes
font_02_sfnt_off00012dd5.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DD5 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.