Malicious PDF — malware analysis report

Static analysis result for SHA-256 99c2a88bce5765a8…

MALICIOUS

PDF

72.1 KB Created: 2021-06-10 00:28:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: f3a722ced29ede29374606a318346709 SHA-1: e7c6f1f8df027603c06c971944e3eb2e76af2306 SHA-256: 99c2a88bce5765a8189af9501e5929e2f75b94d8960aa11d1d0b224b59fa0622
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, flagged as a link farm, and is detected as malicious by ClamAV and an ML classifier. One of the embedded URIs, 'https://crewmak.ru/pbw?utm_term=google+account+manager+j5', suggests a phishing lure related to Google account management. The presence of PDF_SEO_LINK_FARM and PDF_URI heuristics indicates the document's primary function is to redirect users to external sites, likely for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/pbw?utm_term=google+account+manager+j5 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4414679/normal_601afcb701afd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411931/normal_6001714811028.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404953/normal_604d3f159ab1d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381730/normal_5fc7ce6a4269b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4428038/normal_604f196b0cc67.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413000/normal_5fe03bec42391.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383571/normal_6054b4e4aef1a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378425/normal_602ecdc5be17e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480880/normal_5ff2871a70bc6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460706/normal_5fd7f51e89bd0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425504/normal_5feb9486ec88c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447089/normal_6051f7d397940.pdfIn PDF document text
    • https://tetunabirudav.weebly.com/uploads/1/3/0/8/130874278/e50794.pdfIn PDF document text
    • https://jifejajazarig.weebly.com/uploads/1/3/4/3/134307839/4269870.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486763/normal_5feb32d789f9d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408460/normal_5fc61ef8709a0.pdfIn PDF document text
    • https://revixapega.weebly.com/uploads/1/3/4/6/134619396/jepitef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477164/normal_601f13e085cdf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411694/normal_6025353ac357e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6df0df78-c96b-45bb-9328-90ee56290a48/a_court_of_wings_and_ruin_audiobook_vk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d366c588-fef5-431e-97f2-865dba10486e/vw_rabbit_pickup_service_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fb4ce99-639b-466e-aeea-a3ee72c2e99b/roland_juno_di.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d4a3abb-6b4c-46e8-8f99-f54f7a646252/hp_5610_all_in_one_cartridge.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD04 5172 bytes
SHA-256: c34cbad5abd8bdb3bd7d37b817a94c66e485f81bde5bf8c225c68adc62badcc2
font_01_sfnt_off0000ee95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE95 10948 bytes
SHA-256: 2782a5b1d2bfc7eb2a3ac389c409c4975252c912731d7d955fa0bf845d072964

Open this report in the interactive analyzer, or submit your own file for analysis.