Malicious PDF — malware analysis report

Static analysis result for SHA-256 96aa03d8926ca729…

MALICIOUS

PDF

94.7 KB Created: 2021-06-06 02:26:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c88c79f5c69c4ddb6b339ded331777a9 SHA-1: d757984610d7dd63d20384807449eecd86980236 SHA-256: 96aa03d8926ca729f35074e71f2636141a6ea0dca8b8cf21bfe280f8a0613271
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing a large number of external links, many of which are SEO-optimized and point to other PDFs. One of the primary URLs, 'https://medvor.ru/pbw?utm_term=how+to+get+a+efficiency+1000+pickaxe+in+minecraft+xbox', suggests a lure to a website that may host malicious content or phishing pages. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution via a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medvor.ru/pbw?utm_term=how+to+get+a+efficiency+1000+pickaxe+in+minecraft+xbox
    • https://vexojuvij.weebly.com/uploads/1/3/4/3/134345090/8102333.pdf
    • https://visegiwizokin.weebly.com/uploads/1/3/4/7/134721612/suvuzimale.pdf
    • https://pasuliwipo.weebly.com/uploads/1/3/1/4/131452824/14e4fa.pdf
    • https://dosasefezopalan.weebly.com/uploads/1/3/1/3/131398547/9164184.pdf
    • https://vutujevofi.weebly.com/uploads/1/3/5/9/135971838/gorofusezinoruzifise.pdf
    • https://vedabigejiko.weebly.com/uploads/1/3/1/4/131438046/xiwizin-xakogorolixe.pdf
    • https://fupopafesuz.weebly.com/uploads/1/3/4/4/134443157/gazanu.pdf
    • https://pavofadibap.weebly.com/uploads/1/3/4/3/134370944/2af007d5f5d.pdf
    • https://bakavola.weebly.com/uploads/1/3/4/7/134753875/4644864.pdf
    • https://babixedijifaz.weebly.com/uploads/1/3/5/3/135385025/efd6679bb72e8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f8079537-4794-4bca-814c-9d2cd8026c9b/venstar_t2900_battery_replacement.pdf
    • http://zopujoxobug.pbworks.com/f/zunomi.pdf
    • https://uploads.strikinglycdn.com/files/8cac4d9a-0cc2-437c-9162-0fbc652b84c5/99649273589.pdf
    • https://uploads.strikinglycdn.com/files/d4a61c24-f76c-42dd-ad95-6cbd2ef0a71b/how_to_use_first_aid_usmle_step_1.pdf
    • https://uploads.strikinglycdn.com/files/17a26c19-428a-4501-82de-01db67b681fe/62826487547.pdf
    • https://uploads.strikinglycdn.com/files/50ba57c4-417d-43ec-b77a-8f61da7d4b7a/dish_wally_remote_pairing.pdf
    • https://uploads.strikinglycdn.com/files/9740e603-1b88-4f2a-8abb-573f8ead590a/32233787054.pdf
    • https://uploads.strikinglycdn.com/files/41030168-b84a-4b3a-9c69-bb28e1dd2d3a/54420441388.pdf
    • http://sejuworepow.pbworks.com/f/wonawaziriri.pdf
    • https://uploads.strikinglycdn.com/files/c27d4d4a-6658-44a0-87b8-9732c379615f/aws_lambda_download_file_from_s3_python.pdf
    • https://uploads.strikinglycdn.com/files/ce142f8b-7777-4efd-ab6d-69e472e973bd/what_does_a_first_grader_need_to_know_in_math.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ced.bin
17de83ea11db888667a5e0c8fe2fb39c60b53489c62668c7c5711ea32ecc53ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CED 5748 bytes
font_01_sfnt_off0001409b.bin
792be89b359e86e789987a06811c10a73d3867e8daff8b3479d2b2ccef0327d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1409B 13340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.