Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6d6499f9abe960a…

MALICIOUS

PDF

95.8 KB Created: 2021-04-12 01:13:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: a86836501a3192b229c7e0263453c1f4 SHA-1: aef1452ec29151936f450d27a424d22a963a7b26 SHA-256: b6d6499f9abe960a002921743e71bcd0e72fb71e8c27fe74fc21a85fd1431718
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, many of which point to disposable hosting services, suggesting a link farm or phishing attempt. The primary malicious URL identified is https://jottigo.ru/strik?utm_term=how+to+approve+dispatch+in+gcss+army, which is likely used to redirect users to malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=how+to+approve+dispatch+in+gcss+army PDF link annotation
    • https://vuverararusug.weebly.com/uploads/1/3/4/8/134883490/86becb8.pdfIn PDF document text
    • https://dapazigozasonim.weebly.com/uploads/1/3/4/4/134466252/misetuwarerivin.pdfIn PDF document text
    • http://pikegupima.medianewsonline.com/world_history_test_and_answers.pdfIn PDF document text
    • https://xizuxikeg.weebly.com/uploads/1/3/0/7/130740292/wulabaxiz_vituga.pdfIn PDF document text
    • http://werojati.getenjoyment.net/which_of_the_12_basic_functions_have_no_zeros.pdfIn PDF document text
    • http://juwaniwabi.medianewsonline.com/ay_santa_maria_cancionero_de_palacio.pdfIn PDF document text
    • https://vizufawamowimo.weebly.com/uploads/1/3/4/7/134700475/sizevaxokop.pdfIn PDF document text
    • https://weromosamewose.weebly.com/uploads/1/3/4/2/134265498/zidowowitagejuk.pdfIn PDF document text
    • https://tenekitu.weebly.com/uploads/1/3/4/0/134018212/9c8f83.pdfIn PDF document text
    • http://wixujikubipom.mygamesonline.org/65450688982.pdfIn PDF document text
    • http://zonagareme.getenjoyment.net/aeration_control_system_design.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://55d63786-14d6-44de-84d0-33f1fb383c44.filesusr.com/ugd/45fd81_cd4bf779cd76456989173d2b02a4083a.pdf?index=trueIn PDF document text
    • https://a0bbd489-bf03-48a0-8e93-88abd0751e5b.filesusr.com/ugd/370ea2_e9775d39e74249b59b949e984e505ced.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb515856-cc07-463a-8ff5-ba1e19ef4b9a/supply_chain_management_mba_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46943509-7eb1-488a-9e7a-b107850c0e04/is_the_canon_mg3220_a_wireless_printer.pdfIn PDF document text
    • https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_574c1cc742604d4e8deedd6f5d65e49e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/70019828-f4d9-4b51-913f-de6808ad8e0e/tissot_t_touch_1853_instructions.pdfIn PDF document text
    • https://fed4949e-3809-4fc0-a28b-84c5d390f589.filesusr.com/ugd/94482e_c2e26e088b914be69d5cbfb21d91edf6.pdf?index=trueIn PDF document text
    • https://b0cee159-9ce3-47d2-9452-de9e383f1b6b.filesusr.com/ugd/fac5c7_13aabcdadd32411cb19ea90e608ee818.pdf?index=trueIn PDF document text
    • https://14da0a27-f261-4d4b-8668-3a369f5c966d.filesusr.com/ugd/46429b_5c774432f1534bc485e1ebba36eb1dfa.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d3adf5e-9cbb-4497-86c4-f996f33e36b5/80444801618.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73894164-3d2f-4cc5-86d3-9ebb4c12475e/fesozurutosobukigomeb.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013683.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13683 5672 bytes
SHA-256: cbc3d21e4d88951b577b752a79419fd4cd7005ea4d9f0ac44c9146f6a8d6308d
font_01_sfnt_off000149c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149C3 11764 bytes
SHA-256: 007373325f848baca4b892534abf513226188ceca1a2ee61901ec72ffaae5091

Open this report in the interactive analyzer, or submit your own file for analysis.