Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8425f2b5e0c91e6…

MALICIOUS

PDF

79.3 KB Created: 2021-05-04 08:50:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8509f4e7ecb7b047eba7ff8cedf7d89d SHA-1: d8a1e5553bee046235f51df4ce24947445b6e049 SHA-256: a8425f2b5e0c91e63fb3a845a26aefb4926cabc6f1cd3f025facb4b5872830ef
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external URIs points to 'https://seumenha.ru/strik?utm_term=t+fal+pressure+cooker', suggesting a phishing or malicious redirection attempt. The ClamAV detection and ML classifier also strongly indicate maliciousness, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=t+fal+pressure+cooker
    • https://cdn-cms.f-static.net/uploads/4369333/normal_6020aab82d329.pdf
    • https://static.s123-cdn-static.com/uploads/4447464/normal_5fceef0087c9c.pdf
    • https://cdn-cms.f-static.net/uploads/4379602/normal_605ac48a285cc.pdf
    • http://stnold.com/511630355084nxyw.pdf
    • https://static.s123-cdn-static.com/uploads/4454668/normal_5fcc503d16653.pdf
    • https://cdn-cms.f-static.net/uploads/4365636/normal_603844c8bd415.pdf
    • http://agnewjacobs.com/outdoor_family_movie_night_ideassb3ub.pdf
    • https://gekojivigi.weebly.com/uploads/1/3/1/0/131070255/mofidemuvivo.pdf
    • https://static.s123-cdn-static.com/uploads/4393041/normal_6006a3fd57aed.pdf
    • http://invitesistem.ru/directions_worksheetjqw20.pdf
    • https://zodoxofavuzawa.weebly.com/uploads/1/3/1/4/131437464/8217478.pdf
    • https://cdn-cms.f-static.net/uploads/4473637/normal_605f9903ac537.pdf
    • http://kukushpa.fun/mini_dapple_dachshund_puppies_for_sale_near_meo24ym.pdf
    • https://ketuvukelese.weebly.com/uploads/1/3/4/3/134351906/468cf27632d6683.pdf
    • https://cdn-cms.f-static.net/uploads/4411503/normal_601b06697c655.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/patilawasu/king_iso_autophobia.pdf
    • https://s3.amazonaws.com/pokorevalaxex/51640703775.pdf
    • https://s3.amazonaws.com/bopuxosavubare/how_to_check_ink_levels_on_brother_mfc_9970cdw.pdf
    • https://s3.amazonaws.com/vonuxagupeduze/mb_carsoft_7._4_multiplexer_software.pdf
    • https://85d2c5a2-fc31-4f76-86b4-4ebe2abe2bf4.filesusr.com/ugd/a8cc01_4430942c003b40898711e25dc13189c5.pdf?index=true
    • https://a4758657-6aaa-4003-b0f6-1957e800abfd.filesusr.com/ugd/70c1f8_d76d09d3158345f5b55b0c272479f56b.pdf?index=true
    • https://30c74dc1-c3f2-4e71-8253-1ec84f3b94e1.filesusr.com/ugd/b8c6fa_9fa7975487b24bc38c564af1f0f6534d.pdf?index=true
    • https://7605d98d-8b17-4a41-9383-f5c8d5af9bcc.filesusr.com/ugd/2bed4c_f2024b6ddabc4f0ca7ea167740f1d1ea.pdf?index=true
    • https://s3.amazonaws.com/zoxewudunigus/44983343108.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f989.bin
97984dd29da9fbf01e5843371046b8ca08fb3b3f18c6fcade04e43721584d527		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF989 5024 bytes
font_01_sfnt_off00010ab3.bin
f13c9a3a7dc0b7641f6adc0bd3626e3e751b76a6d68c50cebf379ef71e6d6c5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AB3 10912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.