Malicious PDF — malware analysis report

Static analysis result for SHA-256 b64d1d6a379a6dcd…

MALICIOUS

PDF

81.6 KB Created: 2021-03-16 22:56:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f23923f82094570193176ac774c34499 SHA-1: 7779c761de848d45ae1968a38de3e773026e4a7f SHA-256: b64d1d6a379a6dcde52702e96d729e61a59ed75ec876f2c6cc5a36b2acc01e92
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying it as a 'PDF link farm'. One of the primary URLs, 'https://zajinet.ru/strik?utm_term=how+do+you+calculate+calories+in+food', is presented as a search result, suggesting a lure. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. No scripts were extracted, but the structure and linked URLs indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=how+do+you+calculate+calories+in+food
    • http://xadixul.66ghz.com/45803601100.pdf
    • https://dodaxopaz.weebly.com/uploads/1/3/4/8/134865523/runeju_sudofu_sovubekituku_dudulerot.pdf
    • https://pufukowog.weebly.com/uploads/1/3/4/5/134583281/826cb3cfff591b.pdf
    • https://pibiwija.weebly.com/uploads/1/3/4/8/134896476/9289317.pdf
    • https://putonikasobex.weebly.com/uploads/1/3/1/0/131070178/8296388.pdf
    • http://fusafanomogade.iblogger.org/fexitaxevarezalesuv.pdf
    • https://biramufon.weebly.com/uploads/1/3/4/7/134775887/5138761.pdf
    • https://guwosifewutus.weebly.com/uploads/1/3/4/6/134616196/3c60baaafdc.pdf
    • http://kisiguvawatabom.22web.org/carpigiani_k3_parts_manual.pdf
    • https://dubelaxelafef.weebly.com/uploads/1/3/1/1/131164372/76834afd1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c500243d-4850-4536-9443-09d37322ffb1/ninemimirapi.pdf
    • https://uploads.strikinglycdn.com/files/7f9cefcb-ff90-4d07-8bc3-b8acb5da0588/75037410241.pdf
    • https://uploads.strikinglycdn.com/files/98f9e256-38ca-48c0-835e-d8be99e26c97/whirlpool_duet_steam_washer_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/44e1850d-c1bd-45aa-a5ba-f38328d20497/how_to_get_your_drivers_license_in_arkansas.pdf
    • https://uploads.strikinglycdn.com/files/c8ca96d2-5c96-4c45-8776-200d7703cf8e/zufatolebuboxitelalivunov.pdf
    • https://uploads.strikinglycdn.com/files/86c70555-9779-47e3-8efa-86a1112f26ff/ski_doo_skandic_500_service_manual.pdf
    • http://tapavakagazu.epizy.com/kufuvawubujewutaritak.pdf
    • https://s3.amazonaws.com/mamukawaxatali/68759929765.pdf
    • https://uploads.strikinglycdn.com/files/0b13bc85-e857-446a-bf73-04c08faf56db/ap_style_time_format.pdf
    • https://uploads.strikinglycdn.com/files/08cf4e9f-0f24-46cb-8fcc-a5d5e98c9c43/80991504009.pdf
    • http://kimizajoveso.epizy.com/34455187736.pdf
    • https://s3.amazonaws.com/supefujoxopubu/57139979935.pdf
    • https://uploads.strikinglycdn.com/files/4bdc0f5f-e8cc-497a-9d72-74dfd6610400/37625421534.pdf
    • https://s3.amazonaws.com/womirofop/augmented_reality_seminar_report.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff6c.bin
7f46162dfe7ea4269cf57ce4038ab6b61e2687fb9e336b908bce2252e3719286		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF6C 5168 bytes
font_01_sfnt_off00011125.bin
23655d81766731605ca5d4c099ab4ee71c3d612b3748f6518e7363bf52d65cff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11125 11828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.