Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7eccb1af51c18dd…

MALICIOUS

PDF

71.9 KB Created: 2021-05-25 09:05:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: d6fc00b59d76395ff2c9ec589a62b046 SHA-1: 459d4dd9277ad57642a66a1324f71b7203b81730 SHA-256: b7eccb1af51c18dd9783ad8ab56fffdf3c4a146303037671c09281a7dad54b3e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of a PDF_SEO_LINK_FARM heuristic suggests the document is designed to host a large number of external links, potentially for phishing or SEO spam. One of the primary external links, 'https://leonvi.ru/strik?utm_term=buy+zippo+lighter+fluid', is suspicious and likely leads to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=buy+zippo+lighter+fluid PDF link annotation
    • https://xelexezeni.weebly.com/uploads/1/3/0/7/130740222/zanakene.pdfIn PDF document text
    • https://xarudaxukisa.weebly.com/uploads/1/3/4/0/134018653/3787510.pdfIn PDF document text
    • https://kitigenuripoduj.weebly.com/uploads/1/3/1/0/131070171/redukejuxotivapefu.pdfIn PDF document text
    • https://tedifonag.weebly.com/uploads/1/3/1/1/131164063/1197105.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/326b2759-6487-4810-b902-4e5963d8389b/51712505094.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14fd8970-970b-450f-886f-a7568440d9ed/74356930411.pdfIn PDF document text
    • https://s3.amazonaws.com/xovekolamoxe/vazegusof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1b89188-d006-4f36-a7e3-ce9d2fc8f2f0/19553930598.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3476be7-f94a-48f4-ab80-1253f7718541/dd_fifth_edition_character_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f536d86-2d56-4123-bf2b-8fd32a101352/16528289501.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/425bd5b4-0fe6-4bc2-8877-43f2206b79ff/vudagepudirodojefakunexot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51006c3c-4000-443d-aecd-6fe837f7a9d6/37404935794.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44f30e41-5bb0-413e-94aa-ee87d86c3947/a_comparative_study_of_supervised_machine_learning_algorithms_for_stock_market_trend_prediction.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89494764-8837-4f1b-85e1-e47bd3ad151b/breville_bov800xl_parts_diagram.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55b43b69-17b1-48d7-9009-4c019f8529dc/rumble_fish_movie_cast.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2721f58-50d2-4c4c-8ce8-fbea381bf6cd/do_xbox_live_cards_expire_if_not_used.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8dd6cdc5-ba21-426a-95c3-c285a302a08f/7236309706.pdfIn PDF document text
    • https://s3.amazonaws.com/gizonukorad/integral_calculus_for_dummies.pdfIn PDF document text
    • https://s3.amazonaws.com/gewisetug/giwewiviroda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc9c1160-904b-44f6-88b6-09735a2ccc3a/ford_mustang_gt_premium_for_sale.pdfIn PDF document text
    • https://s3.amazonaws.com/wujodibu/weird_scenes_inside_the_canyon_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2200ae29-e3d8-498d-a353-ba591c17ce1f/american_government_power_and_purpose_brief_fourteenth_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/15919753912.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e72e6df7-6dc6-46a6-8c95-ebd4237f5bbe/how_to_read_a_contour_blood_glucose_meter.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA38 5116 bytes
SHA-256: dfbcdd63dfc43aaa5fd4ba085ab6876206362badabd4aadd0ee210fe971b4510
font_01_sfnt_off0000ebb2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB2 11356 bytes
SHA-256: 31d8573440d989f7783f8c4df33a10eed7e72a7939b12a3897e2ba13758a283b