Malicious PDF — malware analysis report

Static analysis result for SHA-256 968cadf2b776f65d…

MALICIOUS

PDF

73.6 KB Created: 2021-06-11 11:14:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a5ed4e83a3d5434d77d1dbee52d7f98b SHA-1: 742385f8aa70921884b53246c07198e7d10eee69 SHA-256: 968cadf2b776f65dc49b0ebaad1a5f5f8c47a6f8b4608583635f3a14a9e5ebb4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or link farm attack. It contains numerous external links, with a primary focus on directing users to `https://crysiq.ru/pbw?utm_term=the+good+millionaire+t+harv+eker`. The heuristic `PDF_SEO_LINK_FARM` indicates a large number of external PDF links, suggesting an attempt to distribute or host malicious content across multiple domains. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/pbw?utm_term=the+good+millionaire+t+harv+eker
    • https://cdn-cms.f-static.net/uploads/4366947/normal_601122ac2a666.pdf
    • https://gilepinewuje.weebly.com/uploads/1/3/4/0/134096317/67b682.pdf
    • https://cdn-cms.f-static.net/uploads/4475728/normal_5fd11dfd4d9c3.pdf
    • https://cdn-cms.f-static.net/uploads/4481275/normal_603448d768720.pdf
    • https://static.s123-cdn-static.com/uploads/4463543/normal_5fdf516b355e5.pdf
    • https://xunatopek.weebly.com/uploads/1/3/2/7/132710497/7059586.pdf
    • https://cdn-cms.f-static.net/uploads/4417834/normal_601d5cb7d295c.pdf
    • https://static.s123-cdn-static.com/uploads/4413000/normal_6008453488f08.pdf
    • https://static.s123-cdn-static.com/uploads/4373004/normal_5ff3a51c8781e.pdf
    • https://static.s123-cdn-static-d.com/uploads/4452206/normal_60b47f290407c.pdf
    • https://static.s123-cdn-static.com/uploads/4464327/normal_5fe5b1106560a.pdf
    • https://cdn-cms.f-static.net/uploads/4447649/normal_605a622173049.pdf
    • https://static.s123-cdn-static.com/uploads/4466146/normal_5fee0cc642bc4.pdf
    • https://cdn-cms.f-static.net/uploads/4480585/normal_6009aeb971eac.pdf
    • https://cdn-cms.f-static.net/uploads/4463034/normal_600ab49473252.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/208cfa86-d9b7-4a4a-bafc-2f6a77d8c4fa/95248499211.pdf
    • https://uploads.strikinglycdn.com/files/d68f2ba7-458a-40c5-aef3-fc3104d9b2f7/why_isnt_my_fios_tv_remote_working.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e314.bin
7893ac70aee652920d6d5fe117d4aa737d4a9e387fe45970cfca91dffc54982b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE314 5132 bytes
font_01_sfnt_off0000f462.bin
a349bd92bd1daf43fd2c5385a142b29746850e63620e43bfd28065295a71a00a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF462 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.