Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba576006f04a8b7f…

MALICIOUS

PDF

82.8 KB Created: 2021-05-20 05:07:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 7c07d010a845c9434f84d5e7a3b38f86 SHA-1: d5bab4ed9f1f58f8ef7ae6d8ea94239d48dc26aa SHA-256: ba576006f04a8b7f8427def4c1e484f460a1507e3337dbcedf88b4e3d262c47a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. One of these links, https://nipisod.ru/strik?utm_term=cats+poop+is+soft+and+smelly, is directly embedded in the document. ClamAV also detected this file as Pdf.Phishing.Trojan, suggesting a phishing or malicious intent. The ML classifier strongly supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=cats+poop+is+soft+and+smelly PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4490140/normal_5ffc2b3a9cde1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490539/normal_604657fd3006e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403282/normal_604317bc1ac9b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414678/normal_5fcee100259ce.pdfIn PDF document text
    • https://sudejewakigalo.weebly.com/uploads/1/3/4/0/134040490/3373374.pdfIn PDF document text
    • https://gewafikawesi.weebly.com/uploads/1/3/4/0/134016732/kesero-tawibov-javanojemakawu-lewolifugopikuj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481157/normal_604eb99bb2537.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491687/normal_6056a5466d551.pdfIn PDF document text
    • https://datugabow.weebly.com/uploads/1/3/4/7/134745554/tabosipokeremakizi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406497/normal_606b613588e49.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459645/normal_6010562b21ce1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451220/normal_603d7c8b151d4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459188/normal_5fdd4af9236c3.pdfIn PDF document text
    • https://segamivudafipem.weebly.com/uploads/1/3/2/7/132740242/e9099079103.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mogedozara/nowosabasulanobatemexini.pdfIn PDF document text
    • https://s3.amazonaws.com/kotenu/pinoy_movies_online_free_full_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/jevelel/57190837601.pdfIn PDF document text
    • https://s3.amazonaws.com/zetubakuz/favourite_things_piano_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/xirixepo/injustice_gods_among_us_gameplay_android.pdfIn PDF document text
    • https://s3.amazonaws.com/zamuriza/gone_til_november_lil_wayne.pdfIn PDF document text
    • https://s3.amazonaws.com/fizufapu/visualforce_email_template_example.pdfIn PDF document text
    • https://s3.amazonaws.com/xupimaral/html_table_css_template.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/43519666965.pdfIn PDF document text
    • https://s3.amazonaws.com/lixasifasi/college_board_test_9_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001065a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1065A 5096 bytes
SHA-256: 9d5f374a6de70fc5793a250c05b5ed00ebaa9c401e7cf47cec98337730d0c798
font_01_sfnt_off000117ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117AB 10716 bytes
SHA-256: 508f92c73f6a2bda9132245350346bbf1435bc4cb2866d8b1a4db793fd99a38f

Open this report in the interactive analyzer, or submit your own file for analysis.