Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f93079b7ad31c0f…

MALICIOUS

PDF

95.6 KB Created: 2021-03-31 05:57:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4f7378d784f0fc0ef4db4e2abdfd54b0 SHA-1: e33bd466adbdd1e3dd68cdd7f3173e2cffe53a57 SHA-256: 9f93079b7ad31c0f32b4be12fc1dc31a374e0218fa34bb1ac945e960a3477fca
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, with a critical heuristic firing for a 'PDF_SEO_LINK_FARM'. One of the primary external URIs points to 'https://lozipotod.ru/wix?keyword=91+s10+body+kits', and another heuristic indicates a mass of external PDF links, with the first being 'http://fanixagef.rf.gd/71792730581.pdf'. The ML classifier and ClamAV detection strongly indicate maliciousness, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=91+s10+body+kits
    • http://xetumejowizaguk.22web.org/how_to_pair_jam_plus_bluetooth_speaker.pdf
    • http://wavobulowuxixi.22web.org/logitech_keyboard_k120_us_layout.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fanixagef.rf.gd/71792730581.pdf
    • https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_743ee0c9b6b64b06926f75ba57d0a11e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6cb6fd1a-b1de-4814-8c9b-892558637165/15666642315.pdf
    • https://uploads.strikinglycdn.com/files/708a85d7-99eb-4cd6-ad69-cdb5b59f5a37/marbury_vs_madison_short_summary.pdf
    • https://ef5e9b3f-1a8e-4c79-9b60-34b8f8133c96.filesusr.com/ugd/18574e_d53e1605a8fa4d53b4ce4ab38739fa92.pdf?index=true
    • http://besoxumewube.epizy.com/raliwixozu.pdf
    • http://kakafemapekumu.epizy.com/reported_speech_examples_for_class_8.pdf
    • https://02314edc-d025-420b-9d62-795437f25c47.filesusr.com/ugd/4f0fc1_c67cb53a8f8b433ba0f76661ea590463.pdf?index=true
    • https://78e27e65-9996-4239-a63d-7a21722db537.filesusr.com/ugd/03f576_b4898e48091843aa82c2478efbfbfd1e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ccb17099-1f5c-4406-abac-b036a4404d7a/sirexarimosipulaxo.pdf
    • https://0793e221-2e7e-4176-aae8-4ff4b75d8f7a.filesusr.com/ugd/64bd79_577e718c8c5443deb7e90962c0ffe189.pdf?index=true
    • http://tipopetudigovib.epizy.com/catastrophes_naturelles_liste.pdf
    • http://difavaxegugadu.epizy.com/46441813992.pdf
    • http://badisaxutut.rf.gd/descriptive_essay_topics_for_class_9.pdf
    • http://demujub.rf.gd/nabotoluxodibeluwojowela.pdf
    • http://numupovejabo.epizy.com/que_es_el_sillao_en_la_cocina.pdf
    • https://3fb740b9-71d8-4183-8edb-de11b68c0a29.filesusr.com/ugd/1fbf8b_d206a7268304460091ee799ddeb9ca66.pdf?index=true
    • https://a32e93c2-1aa3-4149-af29-aa5d163ab988.filesusr.com/ugd/40336e_b4c5314ec52748c9bc7b221153c47c18.pdf?index=true
    • http://vusanaxipunuli.rf.gd/noida_road_map.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013653.bin
c022d46de50ed7a3a94ef1505df731f0ea4d4673e828aae7726a0d8ba3d5f511		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13653 5040 bytes
font_01_sfnt_off00014799.bin
3218fcfff878544c1557b425aa7d7a55ab96f07f2fca339f5bce2c0751337755		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14799 11992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.