Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae5b8e2640575acd…

MALICIOUS

PDF

77.5 KB Created: 2021-06-06 13:01:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e7fd07bd185419de001bf7edd05a7ad4 SHA-1: ca005b14f854ba73bb7162e6d08eb3b1b2b635ea SHA-256: ae5b8e2640575acdadb9b9d788e31195d61a47fbaab0a5e5a933aef46ee2e445
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing trojan. It contains a large number of external links, characteristic of a link farm, with the primary suspicious URL being https://lozipotod.ru/123. The PDF structure and the presence of numerous external links suggest an attempt to redirect users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=video+cutter+and+joiner+software+free
    • https://supuzuvafexag.weebly.com/uploads/1/3/5/3/135383103/8ff2159cf.pdf
    • https://static.s123-cdn-static.com/uploads/4501198/normal_5ff49a39545e5.pdf
    • https://cdn-cms.f-static.net/uploads/4401723/normal_60bc35a10658a.pdf
    • https://lasasokuvob.weebly.com/uploads/1/3/1/6/131607269/xudepem-gefezuwesumebu.pdf
    • https://cdn-cms.f-static.net/uploads/4414174/normal_601744dd2b57b.pdf
    • https://cdn-cms.f-static.net/uploads/4455642/normal_60437d655947c.pdf
    • https://cdn-cms.f-static.net/uploads/4410674/normal_5fd234d42c4e5.pdf
    • https://static.s123-cdn-static.com/uploads/4443372/normal_5fdf885a23a25.pdf
    • https://cdn-cms.f-static.net/uploads/4375528/normal_601753079b89a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://numefen.pbworks.com/w/file/fetch/144640278/physical_chemistry_for_the_life_sciences_solutions_manual_download.pdf
    • https://uploads.strikinglycdn.com/files/f2e5f208-70ff-4526-bf64-fab442be7a86/why_is_go_ask_alice_called_that.pdf
    • http://ridelox.pbworks.com/f/jojibidevud.pdf
    • https://uploads.strikinglycdn.com/files/8923dcd6-b884-45e1-a6ae-4b5d22520c1d/does_the_original_xbox_have_wireless_controllers.pdf
    • https://uploads.strikinglycdn.com/files/79dc4ac9-c1d3-4780-be5c-f30f8d9c0ba6/38663119018.pdf
    • http://ziludezubeju.pbworks.com/f/51245406744.pdf
    • https://uploads.strikinglycdn.com/files/23824bc5-28bc-42dd-a69f-180b196962b6/boaltm_sistemi_yap_ve_organlar.pdf
    • https://uploads.strikinglycdn.com/files/13da7ebb-8d41-493c-87d9-8d8969bd0bcc/ti_82_vs_84_plus_ce.pdf
    • https://uploads.strikinglycdn.com/files/ee84a439-c593-44da-92a6-7c6eb2df6809/lg_hbs_1100_headphones.pdf
    • https://uploads.strikinglycdn.com/files/41bcb755-a488-483a-a222-83ef543b5195/how_to_speed_up_2007_gas_club_car_precedent.pdf
    • http://togusan.pbworks.com/w/file/fetch/144613743/65296529773.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2fe.bin
37172126421064f00dbff31ae31c2f0f445c07b127dfb20918ca4012828e4986		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2FE 5116 bytes
font_01_sfnt_off0001048c.bin
36e6f4f37e6a58846b418a33a3b9421fea8dd5bac1b52a4b807161fb424e7472		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1048C 10616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.