Malicious PDF — malware analysis report

Static analysis result for SHA-256 b09688a5859d77bc…

MALICIOUS

PDF

78.2 KB Created: 2021-03-21 03:19:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 258b633f91841975d13bf627eedaa206 SHA-1: 7f54a50cf1db9a9303f8e4829d0440bbb31d2894 SHA-256: b09688a5859d77bcceb630d6cbc95e4976851a7f4bfd42102dca72c594f5b5a5
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, including one to 'nipisod.ru' with a keyword suggesting a search result for medical guidelines. The 'PDF_SEO_LINK_FARM' heuristic indicates a large number of external PDF links, suggesting a link farm or redirection mechanism. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing or trojan variant. While no scripts were explicitly extracted, the presence of external links and the nature of the heuristics point towards a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=nccn+breast+cancer+treatment+guidelines+pdf
    • https://cdn-cms.f-static.net/uploads/4406777/normal_603e174177d59.pdf
    • http://testvvd.xyz/define_formalism_in_filmieuf1.pdf
    • https://static.s123-cdn-static.com/uploads/4379029/normal_5fc827af249ae.pdf
    • https://cdn-cms.f-static.net/uploads/4449014/normal_6053bdbd9b770.pdf
    • https://static.s123-cdn-static.com/uploads/4487897/normal_5fdf1591ef3d0.pdf
    • https://cdn-cms.f-static.net/uploads/4495050/normal_602f79f358311.pdf
    • https://cdn-cms.f-static.net/uploads/4426953/normal_5fe88eb47728d.pdf
    • http://sberin.xyz/how_to_replace_norelco_hq8_shaving_headslggck.pdf
    • https://static.s123-cdn-static.com/uploads/4419626/normal_5ff0879905b9a.pdf
    • http://opros.xyz/39980232476q4aho.pdf
    • http://bio-ita.fun/61833645845ozzy0.pdf
    • https://cdn-cms.f-static.net/uploads/4480402/normal_6046570a85aa4.pdf
    • http://francobusiness.com/ddp_yoga_coupon_code_2020h25aj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://10bc5e17-7652-4c7e-9b43-999b3eb3b021.filesusr.com/ugd/5edc69_e4822ef3383542ae9dfe4a2a40d3359c.pdf?index=true
    • https://5849b288-062f-49f8-a71b-da420f1f00fd.filesusr.com/ugd/c068f8_bd73e307d9194a80a2d763afe9648cba.pdf?index=true
    • https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_7339ef3451314bd69d624852bffa49d8.pdf?index=true
    • https://19527f6f-7821-4b33-8e58-d909ab9a203f.filesusr.com/ugd/b18fc6_31076e96401f4cc4864471253bb0b9e6.pdf?index=true
    • https://88966db1-4a83-4446-b941-f65022a6235f.filesusr.com/ugd/928e0f_d431cbbbeb0f4504bccbabd9dd31a6ac.pdf?index=true
    • https://67a4337f-2b79-4d04-9c1d-2578c80f4945.filesusr.com/ugd/964009_900e2ef6a0704c0db8271031edb062d8.pdf?index=true
    • https://e8802323-0824-40c5-8a58-19d700e27586.filesusr.com/ugd/50cafd_ee9e730fc9754412b4fa3d3d48dbb5ba.pdf?index=true
    • https://37e0f79d-b0c1-4727-b76d-5b759c81288f.filesusr.com/ugd/9c66ff_8ad63c432fb846b6b62d7a0adafdcd68.pdf?index=true
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_da5875a9c32c47e3b7b73b857eb50a0e.pdf?index=true
    • https://3568ea06-17fa-4787-91ae-86b9aa918cbd.filesusr.com/ugd/8ade13_4c17f4e484864e77a409371ce4b3c629.pdf?index=true
    • https://5c839259-519f-4cee-a1a2-6639d654070b.filesusr.com/ugd/140efa_b7ebc3b533ec4a16aa54f4acda4f3f18.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f325.bin
5792fcb3837daeed5dcd4b67f17db9c34084d925a5b559e34718db6a023e4957		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF325 5584 bytes
font_01_sfnt_off0001060f.bin
2ce814fc7eb86997a87e53cdaa132420e82778c885c24be76b8d76dec31f18fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1060F 10844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.