Malicious PDF — malware analysis report

Static analysis result for SHA-256 b13d558bff4d0a29…

MALICIOUS

PDF

75.2 KB Created: 2021-03-21 07:49:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ac0f357b2f1e55edcb9e015d5a1955a SHA-1: 140cf60b7235d63c89b2734fc5cf8330184fc9be SHA-256: b13d558bff4d0a294922110157195101d68bd4889c13594fcf30d9e3078a25d8
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded URLs, with a primary focus on directing the user to 'nipisod.ru'. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the PDF is designed as a link farm on disposable hosting, suggesting a phishing or scam attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=is+gluten+free+food+good+for+you
    • https://cdn.sqhk.co/kajipazuto/gg5DidM/science_vie_tv_programme.pdf
    • http://maxirem.mygamesonline.org/16698154069.pdf
    • http://sirunome.mypressonline.com/nevawuvudebutafarofuwo.pdf
    • https://cdn.sqhk.co/kenixidoxexi/idqpgj6/beat._ly_music_video_maker_with_effects_mod.pdf
    • http://wimorujul.iblogger.org/pegodawafesereka.pdf
    • https://cdn.sqhk.co/fogobewataja/jfhegir/affinity_photo_flood_select_tool_not_working.pdf
    • https://cdn.sqhk.co/firumefetev/gfq1hht/dichotomous_key_worksheet_answers_dog_shark_rose.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tapexiw/68950677084.pdf
    • http://galiwasik.rf.gd/posisizo.pdf
    • https://uploads.strikinglycdn.com/files/3296be46-74bf-48f2-bece-8fd00ad7c68d/how_to_draw_a_woman_figure.pdf
    • https://uploads.strikinglycdn.com/files/a14fcd7f-0946-47ca-983e-800d77fa35a9/combi_boiler_heat_exchanger_cost_uk.pdf
    • https://uploads.strikinglycdn.com/files/b2d38d5e-6f28-4fdc-8f04-452a058e7932/vufusosimurepujuwo.pdf
    • https://s3.amazonaws.com/jemisajoda/69104758301.pdf
    • http://mafekebokidodat.rf.gd/leveb.pdf
    • https://uploads.strikinglycdn.com/files/8d3bac95-9066-4fbd-958e-de20a6ff65c0/best_orientation_for_lean_to_greenhouse.pdf
    • https://uploads.strikinglycdn.com/files/5abbcf8c-5c74-4817-9d2c-6097e7c6bb84/50712817170.pdf
    • https://s3.amazonaws.com/povelenavuviw/retexafo.pdf
    • http://rafodize.rf.gd/powerpoint_templates_medical_research.pdf
    • https://s3.amazonaws.com/rowubunak/topigeduwutigakudo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9e5.bin
6a7fd4d0f90fa7c03de3ae46a0e62f7b44dbf742cd60eba0fc430d63d99b0e1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9E5 4904 bytes
font_01_sfnt_off0000faac.bin
6c156840fe6ca5b5daf364ffa35cf4b02d3001669143702b6f1532c38ab46154		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAAC 10916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.