Malicious PDF — malware analysis report

Static analysis result for SHA-256 9192d30431dde579…

MALICIOUS

PDF

74.2 KB Created: 2021-04-25 19:09:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 7c6c02f315ff77a7e2a62454d9554545 SHA-1: 2764a96cc4c5f70edf07dc8b6ecab1c131370b21 SHA-256: 9192d30431dde579dbd71c54ff2ec719a923af7c7ca99e64fb4f43d7120214d5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a PDF link farm. One prominent URL, 'https://nipisod.ru/strik?utm_term=briggs+and+stratton+725ex+190cc+engine', suggests a lure related to engine specifications, likely to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=briggs+and+stratton+725ex+190cc+engine PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/sonefuvewutimezilomojefuf.pdfIn PDF document text
    • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_dc8cdfe103df41b08a3f30676526a96e.pdf?index=trueIn PDF document text
    • https://69f6cc44-9198-4e41-bafa-43503dba92bf.filesusr.com/ugd/dec231_de6284f78bdd44e6ba4672b5de4ba87b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nijudow/66610467469.pdfIn PDF document text
    • https://s3.amazonaws.com/lijopavexanuse/what_is_the_programming_language_used_for_coding_arduino_projects.pdfIn PDF document text
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_ee2c959f018d4888abd041e37b3e7d73.pdf?index=trueIn PDF document text
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_8ad6ac1ba80c478cae27cfebc4e2b410.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdb424ce-9589-4d69-a2a0-ea5559d6a97e/zakotiru.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/listen_to_free_music_online.pdfIn PDF document text
    • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_77741f36006b4719b5cac1de5c227f6d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/votuweroxigezog/oscar_et_la_dame_rose_film_complet_en_franais_gratuit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f09e31b2-5b2e-4240-a3fa-fb90a1e4bf4e/guvumipajizedogur.pdfIn PDF document text
    • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_351ee0c2d5bc4500bae80095492e40ac.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b75b777f-8c18-4e91-b30b-ad6274fbd631/sony_nxcam_hxr-nx100_specs.pdfIn PDF document text
    • https://9e1bd277-069e-4713-bdcc-1ab96cf790c3.filesusr.com/ugd/5fd2af_58268c25a849447c8dce0eb41469b4e2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sejakopa/android_9_pie_screen_recording.pdfIn PDF document text
    • https://s3.amazonaws.com/kukupunopedon/bharat_all_songs_ming.pdfIn PDF document text
    • https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_166dd602dda94ae6b083aafbb4c01680.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/321905cf-2eca-4413-b1a8-22f18152b8db/how_to_bluetooth_connect_to_kenwood_dnx572bh.pdfIn PDF document text
    • https://s3.amazonaws.com/dazuxujepov/35902766528.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec839d87-1e3b-4ed1-9d72-e3cde9874638/how_to_use_trimble_business_center.pdfIn PDF document text
    • https://4a1cfc67-5981-466d-a13b-75576fe7431f.filesusr.com/ugd/64e449_d6e901f331704b71ba78d51d181fea34.pdf?index=trueIn PDF document text
    • https://a134ef9b-a212-4d8e-a35f-da3d896bbd40.filesusr.com/ugd/dadc92_52b2ddce2d934dabbfbb26d4be05b2be.pdf?index=trueIn PDF document text
    • https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_9a78d4bff55b413ca75168c3ee1543d9.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4B4 5876 bytes
SHA-256: 368a50635161b115b65af73f456c60795b24d7dd7c338efb97cec4e2f7a7ac73
font_01_sfnt_off0000f8da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8DA 10024 bytes
SHA-256: 46df9e0f4a8a634b6e49fbdf7c2e79424af099a17fee0bf6cce38a4fa8b3a67e