Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d53c375b2a21e13…

MALICIOUS

PDF

82.9 KB Created: 2021-05-29 02:54:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cef7435714c0ebbe13567fe337dc315b SHA-1: d016c5b5b86e3cff399e5614f4d7c83c92ac24da SHA-256: 9d53c375b2a21e135367ae3cc5c9fb6a18836c95b5521db1ec849b63e78d0384
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a URL that appears to be a lure, disguised as a search result for a popular game query. The PDF also contains a large number of external links, suggesting a link farm or SEO manipulation tactic. ClamAV and ML classifiers identified this PDF as malicious, likely a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=can+you+replay+heists+in+gta+5+story+mode
    • https://danodukuwen.weebly.com/uploads/1/3/1/6/131637043/3129800.pdf
    • https://vafuxukosa.weebly.com/uploads/1/3/4/4/134440110/0653c1d.pdf
    • https://samovibemajus.weebly.com/uploads/1/3/4/5/134597991/zejifak.pdf
    • https://tesowikosol.weebly.com/uploads/1/3/4/4/134443777/notaxejewu.pdf
    • https://jatuxifukonexe.weebly.com/uploads/1/3/4/4/134469885/9267894.pdf
    • https://vewudati.weebly.com/uploads/1/3/0/8/130873955/zaleliborokesexi.pdf
    • https://ruzovaberup.weebly.com/uploads/1/3/4/6/134651658/kinolevafizok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8926d291-ed3e-4133-8472-37fe1689b88d/excellence_punta_cana_opening_date.pdf
    • https://uploads.strikinglycdn.com/files/96b60f69-eb29-48d3-8f0a-e88364af7792/al_que_esta_sentado_acordes_ukulele.pdf
    • https://uploads.strikinglycdn.com/files/195805c2-af76-43d4-a1a5-7a640ee394c7/49532812531.pdf
    • https://uploads.strikinglycdn.com/files/d6667073-5f44-49d1-b4e1-2402299dedde/sig_sauer_sp2022_.40_extended_mag.pdf
    • https://uploads.strikinglycdn.com/files/5c897f7b-5467-48b5-ab31-12776e4dd4c0/mistborn_the_final_empire_download.pdf
    • https://uploads.strikinglycdn.com/files/d34e132d-61f5-40a9-be03-fdd4c98642c4/2006_toyota_sienna_battery_walmart.pdf
    • https://uploads.strikinglycdn.com/files/8f4aa17c-dfea-4226-b60c-dc510a652ba4/nujejotute.pdf
    • https://uploads.strikinglycdn.com/files/95e2a9ce-ac65-4d9b-b7f8-c0eaeab6588e/jipubuweruto.pdf
    • https://uploads.strikinglycdn.com/files/9da43954-286c-4785-ac25-f64549a56b40/23307397484.pdf
    • https://uploads.strikinglycdn.com/files/23fe7236-b7e3-45c6-b42e-5891eb19aa63/95439455838.pdf
    • https://uploads.strikinglycdn.com/files/978d708c-4e24-49ee-a650-162864853234/tipos_de_planes_de_retiro.pdf
    • https://uploads.strikinglycdn.com/files/19dab7b4-6f96-4d82-9dc8-bc00d114262e/how_to_start_python_on_macos.pdf
    • https://uploads.strikinglycdn.com/files/5586f75d-4fbf-47c0-b63d-b3e894b33b43/zixudadizu.pdf
    • https://uploads.strikinglycdn.com/files/298fe467-9f9f-43d2-afd1-6d06c754ad34/sketchup_make_unique.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f670.bin
4331f5148d7dff2ff4e4eda483ae9769b91d2c486e897de65e59bf94cb55fa43		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF670 2856 bytes
font_01_sfnt_off0001008f.bin
51aae9e9bdd5959e50a52513e08ce036087826f6a3d87988b6d565028d25cdc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1008F 5504 bytes
font_02_sfnt_off00011320.bin
61576ea18107746e12f9eb5bf92fd8893ce8c1ac6c0ab5f7bce09f8fea461cc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11320 12708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.