Malicious PDF — malware analysis report

Static analysis result for SHA-256 917d4309b70c5793…

MALICIOUS

PDF

71.2 KB Created: 2021-04-04 18:04:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fb89bbc71cf1fff71fbe18b8d10ac1d9 SHA-1: d3cca7829c805ef50e45b4afda8e9e79642c29ac SHA-256: 917d4309b70c5793b2223473c409720de3ac91b54640ed44168e3aecdd8d7b87
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by a machine learning classifier and ClamAV, with the latter detecting it as 'Pdf.Phishing.Trojan'. Heuristics indicate the presence of a large number of external links, with one pointing to 'pelibifir.ru/strik', suggesting a phishing or malicious redirection attempt. The document body, though heavily corrupted, contains text related to a 'Tecknet mechanical keyboard manual', likely a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=tecknet+mechanical+keyboard+manual
    • https://cdn.sqhk.co/dabebasavus/iaKhcjh/mod_among_us_for_minecraft_pe_skins_mapa.pdf
    • https://cdn.sqhk.co/pukikojat/hhbifgc/56832942246.pdf
    • http://tipofeliluget.medianewsonline.com/can_you_track_priority_mail_international.pdf
    • http://bewewafip.scienceontheweb.net/the_killing_joke_ending_batgirl.pdf
    • http://narawodosure.medianewsonline.com/edit_file_online_delete_pages.pdf
    • http://xexogafuko.22web.org/m50_gas_mask_for_sale.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9e14edfd-82da-4502-9194-be93e1b7954f/faliguxirukago.pdf
    • https://d99c26cc-8c68-456d-a039-1a26994c8d26.filesusr.com/ugd/105a8c_db38dd1ff3ed4675ae14a1dee31c6108.pdf?index=true
    • http://mesipupip.rf.gd/tesoguxibifitukavuw.pdf
    • http://tavamikilav.myartsonline.com/wetifiwan.pdf
    • https://5f90d536-2a72-4461-adff-280afd3056cb.filesusr.com/ugd/27c394_273ffbe12b9542b3b7b83a73a9643a40.pdf?index=true
    • https://4bc473c2-84d0-4913-8b4e-281bf44fba2e.filesusr.com/ugd/a25dbd_d5f75184f5a54c46aff43d0ebf27e00b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5a1849ca-3d4e-40b5-bccb-cf93f1839be3/migagigavividarovewixex.pdf
    • https://42cc6f6d-9125-48bc-bce4-1bf15f49b1be.filesusr.com/ugd/7c30af_7b0f5c908b8645659d3b56d0a2069231.pdf?index=true
    • https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_5485fc39bcd0443eacb8759773c9f1e3.pdf?index=true
    • https://507d1b22-ea03-4061-a262-f79425337ca2.filesusr.com/ugd/a374b9_857137e299734ab98a8e2dca4a939a7c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/29410cbe-e111-4a1b-9d9a-fc67bf6673c1/what_if_god_was_one_of_us_original_mp3_download.pdf
    • https://7ffe38df-ef78-47a1-8632-a9c579db478a.filesusr.com/ugd/8ff694_ab859cf027d846698b352eebc78772f0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0692a3a8-8468-417a-a297-5b7603dce90f/gamasigexujanabi.pdf
    • http://sekizipax.rf.gd/metexunujelebeb.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf1b.bin
87262879a7285327af2250313412b15c3758d60b8e01136c360111b3c0f437e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF1B 2900 bytes
font_01_sfnt_off0000d96e.bin
f0158b39e7f494efb4bf6d7fc2468a68bfad5baf3044f00fb538522cc442ed8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD96E 5256 bytes
font_02_sfnt_off0000eb28.bin
cc4b3f3c47daec4c2ee700c88b9a97a0219b6fae849fc85c55bf0557aaa91fc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB28 10608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.