Malicious PDF — malware analysis report

Static analysis result for SHA-256 bac95249e7231d2b…

MALICIOUS

PDF

77.5 KB Created: 2021-04-08 03:51:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 324253da19187123be4b756f5c1189ca SHA-1: 9bab91307381857e56fd7d04127361a6cc644cc5 SHA-256: bac95249e7231d2bbf1be0a430f24fcb03fd4ebdf5855793901ba30df070995f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including PDF_SEO_LINK_FARM and ML_NYX_PDF_MALICIOUS, indicating a high likelihood of malicious intent. The presence of numerous external links, such as 'https://lozipotod.ru/wix?keyword=san+juanito+dance' and a link farm pointing to 30 other PDFs, suggests a phishing or malware distribution scheme. ClamAV also detected it as 'Pdf.Phishing.Trojan'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=san+juanito+dance
    • https://kuxubujokug.weebly.com/uploads/1/3/0/7/130775750/1573299.pdf
    • https://ribebolavat.weebly.com/uploads/1/3/1/3/131398139/tilunumenavevoloxi.pdf
    • https://lugonejiborin.weebly.com/uploads/1/3/5/3/135336075/1a869c.pdf
    • https://xuxijoma.weebly.com/uploads/1/3/3/9/133997678/jijepa-saniti-puboxotome-zebipuwop.pdf
    • https://xizirasifeda.weebly.com/uploads/1/3/4/3/134344010/bakaxugoloru_nixokor_xirowoselav_kuvamafimut.pdf
    • https://gerorajowivorem.weebly.com/uploads/1/3/4/6/134686153/lutiwa_wikasot.pdf
    • https://judadumoxa.weebly.com/uploads/1/3/4/7/134718892/lenasisibo_fofigowibe_suruloru.pdf
    • https://munadixozobud.weebly.com/uploads/1/3/4/6/134635459/4738067.pdf
    • https://butegipabozu.weebly.com/uploads/1/3/4/2/134235803/6063289.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ea93f882-822a-48ea-b6eb-cb7535bb3127/bsc_medical_microbiology_salary_in_india.pdf
    • https://s3.amazonaws.com/fadobirak/chaupai_sahib_gutka.pdf
    • https://7605d98d-8b17-4a41-9383-f5c8d5af9bcc.filesusr.com/ugd/2bed4c_cb149af2add549cc819d92d2e520f7f9.pdf?index=true
    • https://s3.amazonaws.com/vonutavekip/when_do_you_harvest_sweet_potatoes_in_australia.pdf
    • https://uploads.strikinglycdn.com/files/60c90856-0c78-4f10-abb1-3b3e7a153ac8/is_autism_a_disability_in_australia.pdf
    • https://3a7b682b-4b85-4b21-836a-a34929c8735b.filesusr.com/ugd/0cd3a8_d1bc42f1ca0e4f53b021e02fc221f50c.pdf?index=true
    • https://4121a797-204a-431c-92a8-8e24072fb342.filesusr.com/ugd/b972d5_d76f5c9f72fc41f88d7bde6e6c4fc6b6.pdf?index=true
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_7b1654ff1d9d4dbc96f750e1e0b0b3b8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e650c04d-df57-4c84-899d-d49f13e73335/female_sea_monster_names.pdf
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_143d470111084f18be530ece9e7e2730.pdf?index=true
    • https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_9e68beca0d084f47ba416813ab8b2319.pdf?index=true
    • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_02972282dfad4d1e97c0182b3872c690.pdf?index=true
    • https://436240a4-ef10-404e-ad90-c5cab949c7af.filesusr.com/ugd/3fb742_d178e69ef5b64905b51e8dfdb2b2f9cb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef40.bin
ae6b6e8b3c77fa0986ccb3a1feb1cf05f83d07f1e558de3d66df1d1dcb97a92d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF40 4808 bytes
font_01_sfnt_off0000ffaf.bin
ee7e6e2cad69d7e49fc62591752e520a2b52bb18a3072ef3ec62f79d39287f5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFAF 12272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.