Malicious PDF — malware analysis report

Static analysis result for SHA-256 adb874b0d2a11ddb…

MALICIOUS

PDF

123.7 KB Created: 2021-03-12 17:17:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d87bf87b03e40a3557eb3b2e13d08a14 SHA-1: 7ad4e5e110387fb4c787de463ae4fa2e28d2ca12 SHA-256: adb874b0d2a11ddbf2ca2faa46ee2d926abf1709ece91c3a59af6b2504c500fe
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a link farm. One prominent external URI, 'https://lozipotod.ru/award?keyword=applications+of+silicon+carbide+pdf', suggests a phishing or SEO-based lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=applications+of+silicon+carbide+pdf
    • http://gamukanemafutu.mywebcommunity.org/how_to_connect_a_bose_surround_sound_system_to_tv.pdf
    • https://zewelujipe.weebly.com/uploads/1/3/4/8/134846298/pozar.pdf
    • https://cdn.sqhk.co/jesovolavig/thhh7XT/block_fortress_empires_mod.pdf
    • https://cdn.sqhk.co/tivuzofep/jdgd2s9/30742382556.pdf
    • https://cdn.sqhk.co/nogawevorus/aP37geL/judarogimulaji.pdf
    • https://cdn.sqhk.co/kawaniroti/idxbvgg/spiral_lighted_christmas_tree_green_lights.pdf
    • http://povulofi.mywebcommunity.org/norton_anthology_of_english_literature_9th_edition_volume_a.pdf
    • http://ladiluvame.mypressonline.com/principles_of_interpersonal_communication.pdf
    • https://vipegiwofavagob.weebly.com/uploads/1/3/5/3/135302795/4d555f6e9f7.pdf
    • https://wisapemewe.weebly.com/uploads/1/3/4/7/134713478/bijawol.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e8fab753-5085-4fe3-8ddd-89ee5e857819/xofujiloxasubakog.pdf
    • https://uploads.strikinglycdn.com/files/4cae7c3a-1242-43e0-917e-eb077656d0b5/4482870137.pdf
    • http://retiziwo.myartsonline.com/avena_beneficios.pdf
    • http://gumizaxewa.atwebpages.com/u_verse_tv_guide_today.pdf
    • https://uploads.strikinglycdn.com/files/9e303e76-d88e-40a2-932e-bcf1ac81c31a/sap_mm_video_tutorials_free_download.pdf
    • https://uploads.strikinglycdn.com/files/d5253fba-defa-4670-ac12-608391661683/67086517118.pdf
    • https://uploads.strikinglycdn.com/files/124c3790-e70c-47c9-9ed9-74eec667eb7a/talajusumekig.pdf
    • http://doriponesarom.myartsonline.com/microbial_genetics_mcq.pdf
    • https://uploads.strikinglycdn.com/files/d8074ca4-a61e-48a0-ad34-d441cafa4512/dorusovufodiliwiwom.pdf
    • https://uploads.strikinglycdn.com/files/aebe3149-20a0-4f41-8ba3-691a5bf07e72/how_to_replace_samsung_suspension_rods.pdf
    • http://tiluxusimutine.atwebpages.com/mens_vans_old_skool_black_and_white_checkerboard.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000185bc.bin
0d5fa0d06956eef679ca696f37978b8946d1fbefe7cdfeaa686a56274afc9deb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x185BC 5276 bytes
font_01_sfnt_off000197b8.bin
fe4e96f8c3e5ce007909430172adb6fc46fceb45394641743b0ef5939b4c30d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x197B8 16692 bytes
font_02_sfnt_off0001cba4.bin
ae97ebdbf5cb6679ee3ae7f6f8963da9ec2437ada1f672a33085bc8cbe806833		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CBA4 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.