Malicious PDF — malware analysis report

Static analysis result for SHA-256 927c0867df5e0f8b…

MALICIOUS

PDF

78.6 KB Created: 2021-06-09 09:23:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 59c5f9d6f73a17275f5f88acb10c6be4 SHA-1: 72bad7d7231c6ecefed8e7db8f0b33b53b4b6626 SHA-256: 927c0867df5e0f8b30daef15431591381e9d7a9c7c5dc359bd8290f97669a8bb
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent URL pointing to 'nomylo.ru'. This, combined with ClamAV detection as 'Pdf.Phishing.Trojan', strongly suggests a phishing or malware distribution attempt. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, likely to manipulate search engine results or distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=yeh+dillagi+full+movie+watch+online+openload
    • https://cdn-cms.f-static.net/uploads/4388280/normal_6059f431e6a79.pdf
    • https://cdn-cms.f-static.net/uploads/4484154/normal_6016b2dfce0bc.pdf
    • https://vijilipaguwojig.weebly.com/uploads/1/3/4/8/134872157/5521cf770e6e54a.pdf
    • https://static.s123-cdn-static.com/uploads/4385620/normal_5ff56688cf029.pdf
    • https://marezupudi.weebly.com/uploads/1/3/0/8/130874377/lotetosi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wefolevemud.pbworks.com/w/file/fetch/144636798/34193400366.pdf
    • https://uploads.strikinglycdn.com/files/2002ff14-5d4e-44e8-8770-70d08ff8004c/do_trolling_motors_need_fuses.pdf
    • https://uploads.strikinglycdn.com/files/f390b0d5-7f31-4efb-8fbf-8e053bef24fa/how_to_fix_a_wine_fridge_that_is_not_cooling.pdf
    • https://uploads.strikinglycdn.com/files/b379a2d1-38de-474b-aaf6-a7207e8abf0f/how_to_get_google_analytic_certified.pdf
    • http://vifogajo.pbworks.com/w/file/fetch/144605271/35786787157.pdf
    • http://jagimikat.pbworks.com/f/wizofef.pdf
    • http://mavujeridolu.pbworks.com/f/gta_5_free_unblocked.pdf
    • http://lufokomarib.pbworks.com/w/file/fetch/144478437/how_does_flemings_right_hand_rule_work.pdf
    • http://zixereves.pbworks.com/f/spectrum_remote_control_rc122_tcl_code.pdf
    • https://uploads.strikinglycdn.com/files/f4aac1f9-65cd-4276-85a7-e43a5b464c89/how_to_prepare_for_hr_interview.pdf
    • http://furalagaposu.pbworks.com/f/fire_emblem_sealed_sword_english_rom.pdf
    • https://uploads.strikinglycdn.com/files/06159063-f986-400e-8a17-1e400e01c5d1/nips_pain_scale_copyright.pdf
    • https://uploads.strikinglycdn.com/files/0678df14-8dda-450d-8c66-f8e00ccbbfb7/bill_of_exchange_act_sri_lanka.pdf
    • http://guvevef.pbworks.com/w/file/fetch/144843465/fundamentals_of_nursing_8th_edition_study_guide.pdf
    • https://uploads.strikinglycdn.com/files/192f9a0e-7b63-43f2-8b22-6d32d3b7003f/ncert_maths_book_class_8_free_download_english.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e827.bin
5de696e50825e8b7fdbe14da774cc8090842912f3f4f5a1ac2be53f7b3750530		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE827 5292 bytes
font_01_sfnt_off0000fa1d.bin
a7a1e6fbf851caf7eab8994e1cb3155ab98cbc00940a4efba9807de94047fe56		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA1D 10612 bytes
font_02_sfnt_off00011e5b.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E5B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.