Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6c4e9e8c2ad2506…

MALICIOUS

PDF

82.0 KB Created: 2021-04-19 19:24:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: aa321109cb2daf9eac7dd8585a875805 SHA-1: c9e78e9a920c6b474af8b6c26000da23f7136418 SHA-256: a6c4e9e8c2ad250699d711dfe5071d42e0a99b94e4258980aa583dabaf070c5c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to other PDF files, indicating a link farm for SEO manipulation. One of the primary external URIs, 'https://lozipotod.ru/strik', is flagged as unknown reputation and is likely malicious. ClamAV and ML classifiers also identified this PDF as malicious, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=how+to+use+woods+indoor+timer PDF link annotation
    • http://xatitakuv.iblogger.org/nightcore_perfect_switching_vocals.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xirixepo/22377294976.pdfIn PDF document text
    • http://jujonejetas.epizy.com/debutogin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14a2f322-858a-4329-a667-012f0eef5b04/how_do_i_get_my_mac_to_recognize_my_hp_printer.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/balovujumekatewesakuw.pdfIn PDF document text
    • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_f5042435c4a142c38318b64bf1347143.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/576eb230-c1f4-466d-89c9-c0f4b39a5616/84766106540.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3797b4f-d8ed-4210-b473-54aef1f89243/what_are_thermal_neutrons_class_12.pdfIn PDF document text
    • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_73bbdbafbb424411bb588a66ebe49c66.pdf?index=trueIn PDF document text
    • https://e432c3f7-acc0-403b-bc7f-1b8c16782643.filesusr.com/ugd/6a4899_8040e5866698460dac78d6298bad5b11.pdf?index=trueIn PDF document text
    • https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_e3e7f3a0aaee4b0083cbb75766022dbd.pdf?index=trueIn PDF document text
    • https://6e8b94c7-278c-4a65-9c30-8d61c93a8f31.filesusr.com/ugd/9ff9b8_d5d40414a7dd488d899d65b77cbadb16.pdf?index=trueIn PDF document text
    • https://f395d2f2-f939-483b-815f-81062d4747ff.filesusr.com/ugd/be2697_996ad49eb42943b690dbccb1e643eee4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zarelusipofox/58508985530.pdfIn PDF document text
    • https://s3.amazonaws.com/xotomisen/wamemofuvemolinikow.pdfIn PDF document text
    • https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_184ff9b314ab41078d4332893bc53a6e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wizakokowe/genuine_apple_iphone_5s_silicone_case.pdfIn PDF document text
    • https://2c8134a4-d865-4da1-8961-c755d7242105.filesusr.com/ugd/6dcf04_81a35374b218490aac3a1875e39f0c51.pdf?index=trueIn PDF document text
    • http://dagaratula.rf.gd/assertive_behavior_techniques.pdfIn PDF document text
    • http://regipikiwubadov.epizy.com/the_raven_poem_setting.pdfIn PDF document text
    • http://vimedunofonuw.rf.gd/anexos_simples_nacional_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f827.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF827 4664 bytes
SHA-256: 130d27dcc6595d8b03b8a9d17879e7f7b12c18d9bf6f4c437d4fab344674e038
font_01_sfnt_off000107ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107EE 10732 bytes
SHA-256: 3b2537e336e366d6ae21299c2ad5d1a367897b84ff59cd2e91b0282c79cdd342
font_02_sfnt_off00012c72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C72 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.