Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccc8d23d5c32d573…

MALICIOUS

PDF

76.2 KB Created: 2021-03-23 09:50:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d25825fecb16d125960eb05485490d4 SHA-1: 96a6a54ce46c2c9f895716cd77fd33257a5a890e SHA-256: ccc8d23d5c32d5738f8afa8c2c92470df8e4fd6cfeea5ac17f79a1e9be6e8b88
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains numerous external links, with one prominent URL pointing to 'nipisod.ru', suggesting a link farm or redirection for malicious purposes. The document body, though partially corrupted, contains text related to 'Nike air force 1 shadow', indicating a lure to attract user clicks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=nike+air+force+1+shadow+hydrogen+blue+uk
    • http://experiment.website/neduterexuwiwojolaxolajarb37qo.pdf
    • https://cdn-cms.f-static.net/uploads/4420020/normal_602305a76112c.pdf
    • http://kraftmann.su/39829938430bxh0m.pdf
    • https://cdn-cms.f-static.net/uploads/4418001/normal_602cf4c2b9f82.pdf
    • https://cdn-cms.f-static.net/uploads/4489969/normal_6054dff3e7a72.pdf
    • https://cdn.sqhk.co/fazejitev/iahfdhh/team_usa_mobile_coach.pdf
    • https://cdn.sqhk.co/fezivabuja/0lghRVl/30097424330.pdf
    • https://cdn.sqhk.co/jivonaxadu/U4miacB/drought_tolerant_ornamental_grasses_australia.pdf
    • https://cdn-cms.f-static.net/uploads/4489992/normal_6057cb66341a3.pdf
    • https://cdn.sqhk.co/zuxatotukaru/iicjeja/tuwuxalokozekoli.pdf
    • https://static.s123-cdn-static.com/uploads/4379855/normal_5ff59ec8d69ca.pdf
    • https://static.s123-cdn-static.com/uploads/4368266/normal_5fc6c61b1e052.pdf
    • https://cdn-cms.f-static.net/uploads/4380675/normal_6032bbb775510.pdf
    • https://static.s123-cdn-static.com/uploads/4447641/normal_6001711e93e7e.pdf
    • https://cdn-cms.f-static.net/uploads/4421614/normal_6059580f0edfc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_95042d0a34094b7ca70e120d5008e86f.pdf?index=true
    • https://80820154-e864-4b0c-832b-212b24169927.filesusr.com/ugd/c12414_cf12c6ff2a92483f91aea62dc6f71986.pdf?index=true
    • https://dd6f0c70-611b-430f-b219-ee0593fd0e1f.filesusr.com/ugd/d60051_3667ed3116714041b9245bb167099d29.pdf?index=true
    • https://559ef5b4-38f4-491c-95f5-a6f57f0534fb.filesusr.com/ugd/1b862a_eb43a262ecba447a9cb952f8a14a423f.pdf?index=true
    • https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_a628b8c21039428fb3a5093af6bb52b6.pdf?index=true
    • https://fe426b01-1dd0-498a-b08e-7ec37e320b94.filesusr.com/ugd/6b45f0_8f49915201264d99a45c23ded7d59f63.pdf?index=true
    • https://5926284e-b61c-4ed0-95e5-27b9feedd2c3.filesusr.com/ugd/50c35f_ee2900c9d91e44128c162aecc8ee6761.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd44.bin
7b853190f2116118d475008bdfb1fb79ca3f7559719888a0f60c42c43c1c1b27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD44 5704 bytes
font_01_sfnt_off0000f0cb.bin
2c213d558fb7f529aee0227287e6167d22c67aaffc2a031d02cf22aed8a3f878		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0CB 19576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.