Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7f5e1bcf25e0e30…

MALICIOUS

PDF

76.3 KB Created: 2021-03-20 05:18:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aef1f5517226f153a294c44af67e1d2a SHA-1: e437f2e818d36820e6753d09643bd83bd1628e03 SHA-256: c7f5e1bcf25e0e30e58baca1f120cc1263360a7bc16864180541ee3173fadbd6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a "PDF_SEO_LINK_FARM". One of the primary external links, https://nipisod.ru/123?utm_term=triglycerides+diet+sheet, is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=triglycerides+diet+sheet
    • https://cdn.sqhk.co/zuzipogowita/gdb2CZ0/timumiwabezoxu.pdf
    • https://cdn.sqhk.co/jijasitov/gotjjnW/exorcist_3_review.pdf
    • https://cdn.sqhk.co/muvasesuru/Viehdha/67351176746.pdf
    • https://runobutadafe.weebly.com/uploads/1/3/0/9/130969205/ace0b8d2f6c235c.pdf
    • https://renejineb.weebly.com/uploads/1/3/5/3/135322717/gedapogod.pdf
    • https://cdn.sqhk.co/nafolekuge/VKBos42/63174169815.pdf
    • https://rukuzidin.weebly.com/uploads/1/3/4/5/134517246/5228472.pdf
    • http://flylovel.com/49342239160i1hw1.pdf
    • https://tulalesin.weebly.com/uploads/1/3/4/8/134876190/texuxomezalatomakuw.pdf
    • http://copyright-help-report.com/rampage_v_extreme_wifi_antenna1qy13.pdf
    • http://kurs1.xyz/what_is_a_master_reiki_practitioner3cef4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://aefb6378-f3ca-470a-b9d2-22936542d087.filesusr.com/ugd/fe129c_1adbc3af9a4746e9845e27bfba6308fa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/12117e51-c622-4e2f-a61a-3dabb58042c6/inspirational_quote_diary_2020.pdf
    • https://uploads.strikinglycdn.com/files/3498f089-a4e3-4cb4-951b-858ac4e3eaa5/88567458866.pdf
    • https://uploads.strikinglycdn.com/files/f2b05816-d445-480b-9cc1-03a5cfe5c030/future_english_for_results_2nd_edition.pdf
    • https://uploads.strikinglycdn.com/files/1bf0f23d-f497-487b-9d6b-f625a731e7f8/91548954684.pdf
    • https://f84ffea9-2755-49c2-9cb5-47ca8b55fe65.filesusr.com/ugd/0adedf_194d516763984a99924255c39ebafb22.pdf?index=true
    • https://fa90eb46-aa9b-4fd1-a2e8-e903ec8e50a4.filesusr.com/ugd/575fb0_b132a36adf4248de80c1227b42423062.pdf?index=true
    • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_f08a881621d8425ba130238f1bda12f8.pdf?index=true
    • https://6b52f5a6-db44-4d3e-8337-ab33c729cb13.filesusr.com/ugd/f4de5e_ac66769831c34287b0471ed4586ff77d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5dcc8acb-3cac-42b2-84db-075c6527830a/lifiz.pdf
    • https://uploads.strikinglycdn.com/files/b0d4ed8c-abb3-4b4c-9b34-3216cf3e3a91/kitchenaid_professional_600_stand_mixer_6_quart.pdf
    • https://uploads.strikinglycdn.com/files/6a475e5e-6792-4861-8088-f3703db507b2/sipuzofofuremixiwawofifaf.pdf
    • https://uploads.strikinglycdn.com/files/b8a42ba3-f469-4fdf-8cd0-3bbc4cf635b9/rutugoposozubapitinutuji.pdf
    • https://uploads.strikinglycdn.com/files/8e57737d-64cb-4d24-80dc-057a6e4a326a/words_that_start_with_ona.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eea3.bin
7be6327c328adcdc4e0f66ea5be7dbbe99c6f832843d6dea6620a3315eaf4a37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEA3 5044 bytes
font_01_sfnt_off0000ffd4.bin
983371b9305e52fd20da0c3462b9ea40a2c2954ed2458adb5d542c8e17457915		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFD4 10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.