Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0f7c01117ee7199…

MALICIOUS

PDF

56.7 KB Created: 2021-05-25 02:40:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 88a6575ec28c2040d6091337a1e870de SHA-1: 4dac946e297492d65d1429623d4ddb1a419ae0c7 SHA-256: c0f7c01117ee7199d1f9622a289a8c0bb4ed3aac14b6cf4a339fd6b209369a84
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, many of which point to other PDF documents, suggesting a link farm or redirection mechanism for malware distribution. The heuristic 'LOLBin_RUN_COMMAND' and the presence of URLs like 'https://nipisod.ru/strik?utm_term=murder+mystery+dinner+show+orlando' indicate an attempt to trick users into visiting malicious sites. ClamAV detection further supports its malicious nature, likely as a phishing or trojan delivery vehicle.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6222

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=murder+mystery+dinner+show+orlando PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4484635/normal_6022010b60fbc.pdfIn PDF document text
    • https://bunemanedadon.weebly.com/uploads/1/3/4/4/134476229/mekazuk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378836/normal_6051724c35254.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4503524/normal_6004e09dec74f.pdfIn macro / runtime command snippet
    • https://cdn-cms.f-static.net/uploads/4385427/normal_601618beeca80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493597/normal_601ad5856c036.pdfIn PDF document text
    • https://jowisatog.weebly.com/uploads/1/3/4/4/134403507/342e7209245701d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417140/normal_5fed925c1edd6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412767/normal_604b4d7cb1fa3.pdfIn PDF document text
    • https://bazojosazim.weebly.com/uploads/1/3/6/0/136086377/pavuxez.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369914/normal_602977f9b5a74.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453334/normal_602687924e32d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uplIn macro / runtime command snippet
    • https://uploads.strikinglycdn.com/files/5ba9e4b7-6209-49f1-9aab-c34d3fdcf0c2/windows_powershell_ssh_to_linux.pdfIn PDF document text
    • https://s3.amazonaws.com/zijivevip/gekepizapetuwatunatixis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f085aac-5185-49d1-bf3b-1d7458d7bdf7/why_do_atoms_come_together_to_form_bonds.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eae3028b-5803-4cd3-9a7e-2bde0c6368a9/what_order_do_you_read_warrior_cats_in.pdfIn PDF document text
    • https://s3.amazonaws.com/farefasejikap/famivizivepisax.pdfIn PDF document text
    • https://s3.amazonaws.com/kagedatabujo/suffixes_exercises_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2bb48efb-e03a-414d-8c8d-2b8f96f28d4e/whats_left_behind_netflix.pdfIn PDF document text
    • https://s3.amazonaws.com/ragejufa/lilizogizomiwutonejuju.pdfIn PDF document text
    • https://s3.amazonaws.com/timituvupame/camino_frances_etapas.pdfIn PDF document text
    • https://s3.amazonaws.com/xufaxoferugod/88975392127.pdfIn PDF document text