Malicious PDF — malware analysis report

Static analysis result for SHA-256 95a7d3d1c98ea6b5…

MALICIOUS

PDF

80.6 KB Created: 2021-05-30 23:10:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 6a770d00243c7881111e7794be0d4a7d SHA-1: 617b14f0dc5446c09b81d02e9b67bdba0f3c3f37 SHA-256: 95a7d3d1c98ea6b503679f556af00eea21152edfb026149dd56401579bae1250
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, many of which point to PDF files, suggesting a link farm or redirection mechanism. The primary URL, 'https://midufefew.ru/strik?utm_term=how+do+i+get+money+off+my+direct+express+card', indicates a phishing lure related to financial services. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+do+i+get+money+off+my+direct+express+card PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481069/normal_6055f52535521.pdfIn PDF document text
    • https://xupazipul.weebly.com/uploads/1/3/5/3/135325103/5425944.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367667/normal_60088a21df3b7.pdfIn PDF document text
    • https://loputoporebile.weebly.com/uploads/1/3/4/8/134847610/525f526c5a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470389/normal_6065c3e78fe04.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414358/normal_6029e0da69d28.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493873/normal_604d67a64a2b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385617/normal_60473f22954b3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446285/normal_604cff83f284f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380230/normal_5ff09ff056e99.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448985/normal_5fe7a9f6ddc27.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415930/normal_604ed30f3b7ba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491410/normal_6057992d85fdd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474191/normal_604d133516cd8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454575/normal_602f0ad23d159.pdfIn PDF document text
    • https://nosovaranipad.weebly.com/uploads/1/3/4/7/134743093/xudanobovekeleroz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec0f1af2-8fff-494f-a0bc-586442145153/ham_fillet_cooking_time_oven.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0e3c11b-b7e8-4c5f-aafc-cd33c332f699/jujowomomemimutinazid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/668e2ea0-3afd-4e77-ac05-42b6493980f8/goruzulodegaviwo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30b06c35-25a5-4def-8bba-2691f0b44be3/what_is_lscs_delivery.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18cb11bd-a907-43de-8e8f-53f3ce35f995/87178750327.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ec2442d-ee28-4564-aa62-aca964564254/ph_food_chart_healthwyze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/955f9113-4f37-4798-ab1f-d1d58a0e428d/65436712904.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59c5b952-9ab9-4f05-892f-2209e246c96d/zadovopurabopufof.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa23.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA23 5668 bytes
SHA-256: 9bebbea40b4873fa5ac7c688e2e082e30fa21139fa96c1c67f45ba008c7c2b21
font_01_sfnt_off00010d85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D85 10932 bytes
SHA-256: 3689cd96417ba79e5b9b2a87df983bd6af7fb843e4b696fc545f3d3b5238a789

Open this report in the interactive analyzer, or submit your own file for analysis.