Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1d9f6e0d01c27e6…

MALICIOUS

PDF

124.1 KB Created: 2021-02-28 06:27:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 2318e98bf9a111adec0079d72ccab076 SHA-1: adab004c3c67a0a366d804f9e5b5d70537379ce2 SHA-256: a1d9f6e0d01c27e675aa619477d7c14670706d2500c2dab0a9bfe77f43ae9c21
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to SEO-optimized content, suggesting a link farm or phishing attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL `https://gimoguvi.ru/strik?utm_term=how+to+use+trim+command+in+autocad` likely serves as a lure to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=how+to+use+trim+command+in+autocad PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378383/normal_601fa426af213.pdfIn PDF document text
    • https://nakabupibuf.weebly.com/uploads/1/3/4/6/134608610/vasesefipimobol_gulemodi.pdfIn PDF document text
    • https://gazezujebek.weebly.com/uploads/1/3/4/8/134881616/500b3988.pdfIn PDF document text
    • http://limaxinsto.xyz/s3_bucket_cloudformation_parametersv09yr.pdfIn PDF document text
    • http://pannochki-art.com/manopenubofazoruweruzzskpf.pdfIn PDF document text
    • https://borerejo.weebly.com/uploads/1/3/4/0/134040615/6497f09f69270.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408172/normal_603b1072c9cfd.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tuxutedi/java_basics_for_selenium.pdfIn PDF document text
    • https://s3.amazonaws.com/tolivajupeku/learn_portuguese_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jivala/almaty_travel_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/english_exercises_asking_for_personal_information.pdfIn PDF document text
    • http://nujugeteteda.myartsonline.com/wozegim.pdfIn PDF document text
    • https://s3.amazonaws.com/gonima/vidolobem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00019bf7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19BF7 10360 bytes
SHA-256: dd954ebb1256e09be7d2f90afe7eba635fadc8772ede5153261c11a4f60390d1
font_00_sfnt_off0001144f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1144F 37920 bytes
SHA-256: 4a569284b74c35e82025ea640032475904aaed5be37615863a57f4bafa2cd411
font_01_sfnt_off00018ab1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18AB1 5104 bytes
SHA-256: a84a980573156c5185b5f49ef3e66cbfec8d473533b4849322100f18c5a2e95d
font_03_sfnt_off0001b9a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B9A1 12488 bytes
SHA-256: 5662d97da465e66d7394e62bd5b1a071fad02bd6ba5da8b7404a470005c5fcb2

Open this report in the interactive analyzer, or submit your own file for analysis.