Malicious PDF — malware analysis report

Static analysis result for SHA-256 a266e504b57eae61…

MALICIOUS

PDF

73.5 KB Created: 2021-06-02 11:43:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3a9a66e1ee60482cb81a245e56102a0d SHA-1: f626bb3263891dbd7729434cfe64fa522fb470b6 SHA-256: a266e504b57eae61053836e8069a8a9f8981e9f1450fa6653227a027843dadfe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which are to PDF files hosted on file-sharing services, suggesting it is part of a link farm designed to manipulate search engine rankings or to distribute malicious content. The primary URL, 'https://nomylo.ru/pbw?utm_term=how+to+work+a+walgreens+humidifier', is likely a lure for phishing or malware distribution. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=how+to+work+a+walgreens+humidifier
    • https://zulezinema.weebly.com/uploads/1/3/0/7/130776370/7b9cff3782ddcf6.pdf
    • https://xanusikufugab.weebly.com/uploads/1/3/4/3/134371049/9412032.pdf
    • https://kopomitesukov.weebly.com/uploads/1/3/1/4/131453216/jedakaxijozizudiru.pdf
    • https://gipasutojemozup.weebly.com/uploads/1/3/1/3/131379868/fdccd5a0.pdf
    • https://kadenuwu.weebly.com/uploads/1/3/4/6/134674874/tugevimomog.pdf
    • https://wuginimujewege.weebly.com/uploads/1/3/4/7/134714977/4248792.pdf
    • https://xavuzilutose.weebly.com/uploads/1/3/1/0/131070872/8813634.pdf
    • https://tomudonaki.weebly.com/uploads/1/3/4/7/134715401/porabozipewuxi_nanojifodipod_wasopuzululuk.pdf
    • https://kewesolatuveg.weebly.com/uploads/1/3/1/4/131452958/vilozekarinenafol.pdf
    • https://zotabuja.weebly.com/uploads/1/3/4/5/134510490/1ad4411df0f2c.pdf
    • https://cdn-cms.f-static.net/uploads/4453327/normal_60263767078d3.pdf
    • https://cdn-cms.f-static.net/uploads/4478950/normal_6046ee92f28d8.pdf
    • https://xivibivo.weebly.com/uploads/1/3/4/3/134353446/157118dbf0a3c.pdf
    • https://cdn-cms.f-static.net/uploads/4374979/normal_605f01f455e53.pdf
    • https://cdn-cms.f-static.net/uploads/4407991/normal_604cbcad419a4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ca3e4201-f32d-4f2d-ab7a-98af257b990b/kenmore_shift_actuator.pdf
    • http://nuxawakaxaz.pbworks.com/f/57585055000.pdf
    • https://uploads.strikinglycdn.com/files/ca3f842d-4f30-4a81-b6ba-b6a55bbd597e/are_pioneer_woman_pans_safe.pdf
    • https://uploads.strikinglycdn.com/files/b3f6294a-e0f8-496c-9940-e5386294533b/how_to_put_co2_in_sodastream.pdf
    • http://kiletejude.pbworks.com/f/dapefavufuxogovebawabesuf.pdf
    • https://uploads.strikinglycdn.com/files/8ea22ffc-4df6-457a-b613-ba8281a0271d/58810600477.pdf
    • https://uploads.strikinglycdn.com/files/6ab94894-b50a-44f5-8e43-3c1616571e9e/nadupajopekalurazur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7f5.bin
0bcd2d23c5e7d2bd047eb0a355b4f47d7962a6f405449038bf401f1e931a4f16		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7F5 5436 bytes
font_01_sfnt_off0000fa55.bin
e35e41a7db08f175cf4234be52f2b1e4be21ded85254dac74ae4ebbaea32d54c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA55 10376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.