Malicious PDF — malware analysis report

Static analysis result for SHA-256 98219266eb536c67…

MALICIOUS

PDF

79.4 KB Created: 2021-05-26 19:16:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 97dbfdc802157573f45659ced4938829 SHA-1: 61cbef3d09a062d61d04635e1ac1a9dd3db85bce SHA-256: 98219266eb536c67555170d5560a9439b436636cdeca36c0837e739caf0c8ba9
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by both ML classification and ClamAV, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, embedding numerous external URLs, with a primary suspicious URL being https://nipisod.ru/strik?utm_term=que+es+la+proporcion+directa+e+inversa. The document's structure and embedded links suggest it is designed to redirect users to potentially harmful content or phishing sites, possibly disguised as book summaries.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=que+es+la+proporcion+directa+e+inversa PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4498986/normal_6063138f85682.pdfIn PDF document text
    • https://dununatanag.weebly.com/uploads/1/3/0/7/130775655/xibid-tisov-lovorinuroso.pdfIn PDF document text
    • https://setupazaz.weebly.com/uploads/1/3/4/7/134772318/jiposef_menobet_tuwub_napiwedogeba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382966/normal_60171d4fde0d2.pdfIn PDF document text
    • https://xavelimati.weebly.com/uploads/1/3/5/2/135298033/gowixagumamije.pdfIn PDF document text
    • https://tomolipuxoris.weebly.com/uploads/1/3/4/7/134708775/puvifosurus.pdfIn PDF document text
    • https://tiputanamadavok.weebly.com/uploads/1/3/5/3/135314880/mozonu.pdfIn PDF document text
    • https://musazulawikale.weebly.com/uploads/1/3/5/3/135305526/3ffa2c6e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480732/normal_5fe87efd53127.pdfIn PDF document text
    • https://tegomufowake.weebly.com/uploads/1/3/5/9/135958876/e80f9f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446275/normal_5fcb047348c88.pdfIn PDF document text
    • https://tatagufok.weebly.com/uploads/1/3/4/6/134692967/66d85bed2f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458150/normal_6044224023280.pdfIn PDF document text
    • https://lupojevoken.weebly.com/uploads/1/3/4/4/134468235/914352f3ff35.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fea9a19-cec9-4008-876d-19c78466573e/short_summary_of_the_book_heart_of_darkness.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4fe540a-0497-40a2-9235-7151e6ea9d3e/17213507577.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cedcdfb7-fc37-4f35-82cf-bc61453732aa/craftsman_garage_door_opener_remote_control_programming.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b107db0-a74f-4e51-87c2-b25bc15240c1/how_to_open_your_chakras_with_crystals.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4c6979d-5c2d-4bf8-8c01-705dac743515/66866041234.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ae90a91-219f-41fd-8f9d-df884b97f4e3/fasofedavenuforezinifu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d97d6f3c-5ab2-4071-a105-0151a7e0cade/what_is_the_best_20w50_motorcycle_oil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a70cd9b-e42f-4af5-835c-6e9aae69afe8/lowonavotitifo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/840921e5-ac19-4af7-a12e-4b5fdd93cb8f/91619100274.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/151adc60-e873-42fe-a026-607634ad50eb/86096434325.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0695187c-8522-485a-b64d-161ed21b5dec/present_continuous_tense_wh_questions_exercises.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f59b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF59B 5188 bytes
SHA-256: 837e02addc16544046231dba092da9aafec2ff9395d58d2f7058747d166675d6
font_01_sfnt_off00010754.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10754 11988 bytes
SHA-256: 2f695cf32f2eb5f66f616b65e6f5aeb2031fee932b03d77b185750370994b909

Open this report in the interactive analyzer, or submit your own file for analysis.