Malicious PDF — malware analysis report

Static analysis result for SHA-256 83b6df6a16fd7f1e…

MALICIOUS

PDF

100.2 KB Created: 2021-03-28 22:49:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f20141926f17f43a34d6000fae16e7dd SHA-1: abc15e21fe87e57ffc580b2990c49949142459d4 SHA-256: 83b6df6a16fd7f1efea8873ea1c0d2dfd32a877e64bdee5fda27fddecb698b29
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and a high ML score. The PDF_SEO_LINK_FARM heuristic indicates the document contains a mass of external links, with the primary URL being https://nipisod.ru/123. This suggests the document's purpose is to redirect users to a collection of other potentially malicious or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=el+decameron+boccaccio+pdf
    • https://cdn-cms.f-static.net/uploads/4489993/normal_6060aef523c89.pdf
    • https://cdn.sqhk.co/nimabugokofa/Oj0mieJ/xalunifaremujewuliniguf.pdf
    • http://lnstgramhelpcopyright.com/buruzuzidomodafinimumaharwx.pdf
    • http://lessonsonline.site/wasted_a_memoir_of_anorexia_and_bulimia_freejzmgx.pdf
    • http://portkamesto.site/115369036294s3ye.pdf
    • http://fsbsiod.com/571261283320uzqt.pdf
    • https://cdn-cms.f-static.net/uploads/4496372/normal_6056f1d3ab52c.pdf
    • https://cdn.sqhk.co/wepigosogo/ahiV9jg/sodijomodejakuzixoja.pdf
    • http://fionainthefield.org/god_of_carnage_play_running_timefj49a.pdf
    • https://cdn.sqhk.co/dukoredod/ajcQhfv/zixepenipul.pdf
    • http://findattime.com/pubonujasy4r1.pdf
    • https://cdn.sqhk.co/nifodotiriru/uhehcah/poached_egg_recipes_brunch.pdf
    • https://cdn-cms.f-static.net/uploads/4445871/normal_6054936805e16.pdf
    • http://zoosalon.org/best_knife_sharpener_amazonqu5as.pdf
    • https://static.s123-cdn-static.com/uploads/4450635/normal_6008b148995ec.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://5e024257-ca51-40df-b6b5-a3104c7b7124.filesusr.com/ugd/97368a_eba84ee1d7084ebea755476d9d28ba4f.pdf?index=true
    • https://aa4c2489-c93b-4667-afab-104bf5323bad.filesusr.com/ugd/8b49c6_4c4afc9843704ed7ac54ca1d3c7ee487.pdf?index=true
    • https://70fbc5f3-53e4-4072-9ff7-a5862d19847b.filesusr.com/ugd/bb3bf9_07cb00db32ab462dab35d072f4f5ac51.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014281.bin
47eb7cb012eb169ac1a4f5c11b70b1f4ccaab8fe123673c5b03d7d9653d06df2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14281 5220 bytes
font_01_sfnt_off0001542c.bin
327e6b49d4ad2b90d7484dcbe0338cfab7f18caea86723dff2c83e127842a190		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1542C 15560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.