Malicious PDF — malware analysis report

Static analysis result for SHA-256 86f10700efc2b34a…

MALICIOUS

PDF

79.2 KB Created: 2021-04-26 07:04:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b5f7b0cd4520c5fb18518b7a2495de29 SHA-1: 96161437e0b3edfa0660335becf91de94052f223 SHA-256: 86f10700efc2b34a19378edfba16a94846fe14e294531621631f390f2534b38a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a phishing or SEO manipulation tactic. The primary malicious URL identified is https://pelibifir.ru/strik, which is likely used to host a phishing page or a further stage of the attack. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=what+are+the+words+to+the+poem+in+flanders+field
    • https://static.s123-cdn-static.com/uploads/4491173/normal_5fed164ce488b.pdf
    • https://static.s123-cdn-static.com/uploads/4465000/normal_5fec21e251b5f.pdf
    • https://juloxiwam.weebly.com/uploads/1/3/5/9/135967800/e1c67.pdf
    • https://zixokamewi.weebly.com/uploads/1/3/4/3/134386319/521528.pdf
    • https://static.s123-cdn-static.com/uploads/4409811/normal_60078a29a2631.pdf
    • https://cdn-cms.f-static.net/uploads/4447903/normal_602405b21339d.pdf
    • https://tamilavijunaw.weebly.com/uploads/1/3/4/5/134506647/9529956.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ede36962-9452-4451-b182-fa4236ba9bc6.filesusr.com/ugd/83b1b3_8b1bf357ee364555bc1d3dac614c1cc5.pdf?index=true
    • https://f4ef19d8-372f-49db-bbb6-0f5e16bfa625.filesusr.com/ugd/070799_daf73a49ea1a4084afed3848da829d3f.pdf?index=true
    • https://s3.amazonaws.com/guxosa/mexib.pdf
    • https://a4067306-84c0-45ce-9c36-3cbb795fcb37.filesusr.com/ugd/d5b970_6fe2d17c689c4f9ca7227664fbde2455.pdf?index=true
    • https://s3.amazonaws.com/poresi/goxupozafapiriv.pdf
    • https://s3.amazonaws.com/pasutiz/tunavewumufixefajezu.pdf
    • https://s3.amazonaws.com/rutufokedizon/defekimadurolopezizoj.pdf
    • https://ad646471-8556-449a-8150-55a6f6ff724f.filesusr.com/ugd/7a1c5b_c26bb2b6fb264ae88f5d32c6a717609b.pdf?index=true
    • https://6648aa49-deb3-4d6f-81a8-a63cc7a297fb.filesusr.com/ugd/38eac1_d2095669b7ee45848082657445df2621.pdf?index=true
    • https://2e81f42f-67f9-46a9-89e2-a5f3ab3b03ee.filesusr.com/ugd/f138f5_debd6114c427413ba7b4a304a3f99e36.pdf?index=true
    • https://22e365c6-0853-42e1-82f8-83473bf9c0bf.filesusr.com/ugd/217d68_d3ba1bb2c39940efaff4cb78034916b2.pdf?index=true
    • https://6fd4412c-3e6e-4f21-a9af-8137ffc6c0d9.filesusr.com/ugd/03469c_208d4dbc078840afb1c999b4ea7cbfa8.pdf?index=true
    • https://s3.amazonaws.com/toguvaju/versa_lite_vs_versa_2_charger.pdf
    • https://s3.amazonaws.com/bisazabe/fraser_forster_clean_sheet_record.pdf
    • https://s3.amazonaws.com/sesijesule/37616368450.pdf
    • https://db244590-af71-4c33-bd6e-2f8f55f31281.filesusr.com/ugd/fdab61_6ba53fc4f39c406a9480ee8d72557926.pdf?index=true
    • https://559ef5b4-38f4-491c-95f5-a6f57f0534fb.filesusr.com/ugd/1b862a_02e38e6393d64b2c8fb4a315a55252bd.pdf?index=true
    • https://s3.amazonaws.com/remufuzu/thanksgiving_math_worksheets_3rd_grade.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7c1.bin
f34d207150a71656959abbef894df23fc7d7f6b67052372dee124bc391a73cf8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7C1 5388 bytes
font_01_sfnt_off00010a02.bin
2e634a4c9f25c4153ebee23667268df48d5b76482ce7e14a00102bf6ff4d60d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A02 10912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.