Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfb7513e3dd38ff2…

MALICIOUS

PDF

115.7 KB Created: 2021-03-23 12:03:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9f5e80dd20e06db83461ebda1fd87fe7 SHA-1: 7b9f828c9b8a0ec2eb8afffaf3038bb2f3461673 SHA-256: bfb7513e3dd38ff285cac3f8a226f889739bbc98abf75bb6b1e19b610ebb649a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are to benign-looking PDF files, but one prominent link points to 'nipisod.ru'. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, suggesting a link farm or SEO manipulation tactic. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution via the linked URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=exploration+sheet+answer+key
    • https://cdn.sqhk.co/buzosefif/djcigAn/34629145512.pdf
    • https://cdn.sqhk.co/gupukutolet/XKrg9E1/venmo_card_atm_limit.pdf
    • https://cdn.sqhk.co/fujalapevame/gfjaRje/38949677441.pdf
    • https://cdn.sqhk.co/jatobeguji/YieLhdW/run_run_super_v_mod_apk_download.pdf
    • https://cdn.sqhk.co/kugefiruxat/fGibFhi/syllabus_gh_app_download.pdf
    • https://cdn.sqhk.co/lozuzupadis/ZiaicMJ/download_clash_of_clans_setup.pdf
    • https://cdn.sqhk.co/foroboreb/e3jeNr3/donald_duck_oil_painting.pdf
    • https://cdn.sqhk.co/zatufora/jidhNje/fairy_party_claris.pdf
    • https://luwomobesu.weebly.com/uploads/1/3/4/2/134235002/fejixeju.pdf
    • https://darurirajilubi.weebly.com/uploads/1/3/4/3/134318819/0b0ebedf47b76eb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_a69e1e685c9f4a1d9137ac23370b5515.pdf?index=true
    • https://s3.amazonaws.com/didowugorokirug/bomumilazisoziturilem.pdf
    • https://a72a44ae-2aae-4d6a-a6c4-235301d0a62e.filesusr.com/ugd/57436b_c0717100e50146358585900a6971ace9.pdf?index=true
    • https://s3.amazonaws.com/lusabifef/stylish_cv_template_word.pdf
    • https://s3.amazonaws.com/vifusupegiza/jingle_bells_trumpet_sheet_music_easy.pdf
    • https://s3.amazonaws.com/wemupajese/ceo_full_form_in_kannada.pdf
    • https://8dfdba76-182f-4dc4-9dda-37a8c8d09dc9.filesusr.com/ugd/4ae4db_d684f38b1a10476d9eb00d64a790f542.pdf?index=true
    • https://8a5a474a-a671-4857-921d-d1df0ee72544.filesusr.com/ugd/523716_1987efea65e148d99635dd934570d282.pdf?index=true
    • https://s3.amazonaws.com/tipikaxe/xoxami.pdf
    • https://ecf1b359-4982-44d9-836f-7e6f5fec4aa1.filesusr.com/ugd/da15c8_b97664e9d6944e23903b283ad536b708.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001839c.bin
4a2e9cf10f465380d2004ec4da0ce82f0bfe168221b6a3ae6338cd38e8be1c38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1839C 5192 bytes
font_01_sfnt_off00019555.bin
e262be2b2fafcb39dc4415347c26a5520462d5fc5b58b01ff60a3f4cf40eb791		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19555 13132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.