Malicious PDF — malware analysis report

Static analysis result for SHA-256 94028011e2f12190…

MALICIOUS

PDF

72.0 KB Created: 2021-04-22 14:29:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: a428562967226cf88e98f3253ce4b706 SHA-1: 74b9eab6481cea451d1ce691c396e0f811e14090 SHA-256: 94028011e2f1219090497b8d21c27b5090b67f1ad6e405745aa88bfd83f93faf
214 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many of which point to redirector infrastructure or potentially malicious sites, as indicated by the 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' heuristics. The ML classifier also strongly flagged this PDF as malicious. The primary malicious URL identified is https://crophysi.ru/strik?utm_term=monitor+card%25C3%25ADaco+speedo+58011g0eg+manual, which is likely used for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=monitor+card%25C3%25ADaco+speedo+58011g0eg+manual In PDF document text
    • http://sakaxek.mygamesonline.org/80468775022.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467950/normal_60052e339f12d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477147/normal_5fd665a4a4195.pdfIn PDF document text
    • http://kajipim.mypressonline.com/45247366354.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454167/normal_5fd179f5273e1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388163/normal_6009c4a2a5504.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://393102e6-89af-4738-8cad-89662dba8dc5.filesusr.com/ugd/33a16d_ac62fb61cca44f909415299f8516475a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nilafafakem/gpsmap_62s_for_sale.pdfIn PDF document text
    • http://guvedizimokid.rf.gd/maze_runner_first_movie_explained.pdfIn PDF document text
    • http://setovoj.onlinewebshop.net/ielts_reading_question_types_and_tips_filetype.pdfIn PDF document text
    • https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_b473ebddac204ec6a27037c1f0e7c22e.pdf?index=trueIn PDF document text
    • https://a867a740-3546-49c9-bb92-c76f735cad7e.filesusr.com/ugd/c312ff_94359d618632475d98f24f3cda95b55f.pdf?index=trueIn PDF document text
    • http://gibilumopujilot.epizy.com/20701496339.pdfIn PDF document text
    • https://s3.amazonaws.com/kuboki/vutenisujobit.pdfIn PDF document text
    • http://lenixad.epizy.com/world_conqueror_3_campaign_guide.pdfIn PDF document text
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_115139e50ad04450839f576dee6f1b93.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pazerogasarinu/jelolewiranix.pdfIn PDF document text
    • https://s3.amazonaws.com/bejokazemur/ceilidh_music.pdfIn PDF document text
    • https://s3.amazonaws.com/mejados/tirafatudas.pdfIn PDF document text
    • https://s3.amazonaws.com/kiremefegonar/7653101109.pdfIn PDF document text
    • https://s3.amazonaws.com/gazitif/sos_meaning_in_mobile_full_form.pdfIn PDF document text
    • https://s3.amazonaws.com/feseni/lancer_rpg_character_sheet_1._8.pdfIn PDF document text
    • https://d3df31c7-72fe-42b1-a92e-0723e8ed7a16.filesusr.com/ugd/5bf82b_6ece67ac331a470a98e866ac4b62a509.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nosepevozux/sabivexodokopu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d34a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD34A 5964 bytes
SHA-256: a8c6cbf9439b799856b79982e539ab8f06d3264df60dc92de7c7078f0ba76a0d
font_01_sfnt_off0000e794.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE794 13240 bytes
SHA-256: 1d0c6b05815124cf02bf988d6c0d2ee85cb02851229ca994b55adf2bf360f514

Open this report in the interactive analyzer, or submit your own file for analysis.