Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b70a355427bb2b0…

MALICIOUS

PDF

64.0 KB Created: 2021-05-16 13:30:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b3b17dc254b07a5b271a95f73cf16794 SHA-1: 53f550d4f4d16961fde617bca919e73b27920cd7 SHA-256: 9b70a355427bb2b04515fe1fece9f3b28eb8d21bb5d2df8976ed4e637e9212f1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to other PDF files, suggesting a link farm or redirection scheme. The ClamAV detection and ML classifier indicate malicious intent, likely phishing or malware delivery. The embedded URLs, such as 'https://resalured.ru/strik?utm_term=the+top+100+drugs+book+pdf', are suspicious and likely lead to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8603

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=the+top+100+drugs+book+pdf
    • http://uscreditreport.info/health_information_technology_degree_worth_itegrtc.pdf
    • https://cdn-cms.f-static.net/uploads/4403418/normal_6065169c829b5.pdf
    • https://cdn.sqhk.co/linotepibubi/BbmjimV/pirates_of_caribbean_piano_sheet_music.pdf
    • https://cdn.sqhk.co/teketerep/y5hewd1/bedivotebiwapajoxifof.pdf
    • http://sadinexiwa.mygamesonline.org/77719166488.pdf
    • http://shoop-fr.ru/rizunt3bks.pdf
    • https://xibowawagapuj.weebly.com/uploads/1/3/1/3/131383975/800188.pdf
    • https://cdn.sqhk.co/wovupeni/ih9iaib/99758025801.pdf
    • https://static.s123-cdn-static.com/uploads/4410433/normal_5fcc806b67d24.pdf
    • https://cdn.sqhk.co/baxewoxevum/UhhfIXN/barcode_scanner_and_label_printer_all_in_one.pdf
    • https://sizadefo.weebly.com/uploads/1/3/4/3/134381744/97527d15d14f5.pdf
    • http://sosyaltakipcipanelin.com/old_newspaper_templates_google_docsuqqcc.pdf
    • https://cdn.sqhk.co/kimorotadopo/jbcXii1/is_dark_red_blood_in_stool.pdf
    • https://cdn.sqhk.co/rizijuwet/fakjjfE/58497867197.pdf
    • https://cdn.sqhk.co/sururezog/Jjdjdib/mefajoniwe.pdf
    • http://degimogug.mypressonline.com/alcanos_alquenos_y_alquinos_ejercicios_resueltos.pdf
    • https://cdn.sqhk.co/mapetidul/eQuiajd/lapejesuwatotonituzud.pdf
    • https://rulewosiziruzo.weebly.com/uploads/1/3/0/7/130739522/lulino.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gofumakexoj.onlinewebshop.net/ibps_exam_material.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de65.bin
a0888724b077a0bfaccbc725bc49986772d7055accca1df12b11f92ab2da1d89		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE65 5408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.