Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5a1a63f12a5fe29…

MALICIOUS

PDF

83.2 KB Created: 2021-04-28 07:32:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ccef810b16f70629bc34ebb7b6b18268 SHA-1: 2aec5516086d88c6fc12914ef9d34ac2d7209204 SHA-256: b5a1a63f12a5fe2953435c09d5e92c2a1869fff44a562a2fdc149f4354ec93be
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier with high confidence. It contains a large number of external links, many of which are likely part of a link farm designed to obscure the true malicious destination. The primary malicious URL identified is https://lozipotod.ru/strik, which is likely used to host a phishing page or deliver a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=lg+lp1213gxr+parts+window+kit
    • https://static.s123-cdn-static.com/uploads/4420014/normal_60029c1f86f31.pdf
    • https://static.s123-cdn-static.com/uploads/4401692/normal_5ffe4d0054a43.pdf
    • https://cdn-cms.f-static.net/uploads/4481403/normal_603bf58652507.pdf
    • https://kuvenamowafave.weebly.com/uploads/1/3/1/3/131379608/1a00d4ce47061c.pdf
    • https://cdn-cms.f-static.net/uploads/4403271/normal_600d89f7e02e7.pdf
    • https://static.s123-cdn-static.com/uploads/4495550/normal_5fc9bed94f9a6.pdf
    • https://static.s123-cdn-static.com/uploads/4496853/normal_60098001005bb.pdf
    • https://lepoboniw.weebly.com/uploads/1/3/0/9/130969744/gupapimutulud_zoforijinikixer_bumulije.pdf
    • https://static.s123-cdn-static.com/uploads/4380214/normal_5fee84bf1b59b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/feseni/56598945604.pdf
    • https://s3.amazonaws.com/robumuduluwise/98533086710.pdf
    • https://uploads.strikinglycdn.com/files/025068ec-9a92-4fc2-a7ac-24d28f1282f1/xufazekasepeto.pdf
    • https://uploads.strikinglycdn.com/files/6fb08c6c-0e83-4c7e-91f2-969fc1a23f4a/pagux.pdf
    • https://s3.amazonaws.com/vavabi/minister_for_financial_services_australia.pdf
    • https://uploads.strikinglycdn.com/files/7121b34b-a58a-4462-b7d1-3f98741cbe5a/94198289997.pdf
    • https://s3.amazonaws.com/gelawiweza/killing_eve_codename_villanelle_summary.pdf
    • https://s3.amazonaws.com/rorives/formato_de_contrato_mantenimiento_preventivo_de_aires_acondicionados.pdf
    • https://uploads.strikinglycdn.com/files/2f876bfb-42e4-48d9-a0e9-402132fd25ca/how_to_call_inquisitormaster.pdf
    • https://uploads.strikinglycdn.com/files/c232f62d-edd0-44f6-9be5-91f16452ef49/76426120037.pdf
    • https://uploads.strikinglycdn.com/files/59a5f972-9103-4597-a028-7274e8e20865/73300167417.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f735.bin
bffd0bcbf22baf877bdb95170acb60dc050b670beab63bdc2176cccd707f3d09		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF735 3160 bytes
font_01_sfnt_off00010298.bin
d578015672e6882dfbd917cf28c9b244c22912787370dec43d78adff8fa932cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10298 5640 bytes
font_02_sfnt_off000115f9.bin
031c31eade3548592b2619deb26daa2e4c2ecce33516e2cb14c4de2589969a7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115F9 11680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.