Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1cebddbebd37634…

MALICIOUS

PDF

78.7 KB Created: 2021-04-29 19:09:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18a9f7e9f73a480059e9af36dfa08679 SHA-1: 5e4a280cfb50194de825d5f8d3f5b2c26ca93497 SHA-256: d1cebddbebd376345f30f9e3c85698cda7b8f2e10997e9350ae154c8afb84bd7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a link farm, indicating it is designed to host numerous external links. One prominent URL, 'https://lozipotod.ru/strik?utm_term=toyota+camry+se+2019+price+new', is presented in a way that mimics search results, suggesting a phishing or scam lure. The ClamAV detection and ML classifier further support its malicious nature, likely related to phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=toyota+camry+se+2019+price+new
    • http://tozepimituxagus.iblogger.org/wowupabi.pdf
    • https://cdn.sqhk.co/bagojenul/ig7cqja/53674497830.pdf
    • https://cdn.sqhk.co/risenulowo/hezha8f/all_words_in_battle_of_hogwarts.pdf
    • https://cdn.sqhk.co/komajekolino/FxDjhib/wanopodoziludofafitakit.pdf
    • https://cdn.sqhk.co/gufojakig/izhbjg7/hide_and_seek_maps.pdf
    • https://cdn.sqhk.co/nifodotiriru/2jglyd6/dibiredojutufejeboviragav.pdf
    • https://cdn.sqhk.co/vugasoveg/1niaHhc/internet_download_manager_for_macbook_air.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b19b3b79-9ae2-4e99-9b16-ef32671d60f4.filesusr.com/ugd/0bc867_78e119c934fc4aa3a319c3580c3bae60.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d2e1fee3-9871-47d1-9651-d72bf5e4f275/intermatic_timer_switch_installation.pdf
    • http://lejonawazemu.rf.gd/carl_sagan_cosmos_download.pdf
    • https://ec679cc6-872a-45a8-b2fd-b1bc8f6ddb77.filesusr.com/ugd/d1d005_781342f77db241fb862905cc78f98674.pdf?index=true
    • http://perorudo.epizy.com/36308027267.pdf
    • https://5b0e1d79-1acc-45ba-a965-31015372eee8.filesusr.com/ugd/67f5f7_b22d11c493e742d298ae73641cd921a4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5bdc1109-7427-49b6-80ed-eb745d8d9357/best_buy_sale_on_beats_headphones.pdf
    • https://uploads.strikinglycdn.com/files/d416e5b2-9917-4fa2-a5e5-05e03d5c26ed/sikowozuzufefojenalagosu.pdf
    • https://uploads.strikinglycdn.com/files/3140ceb0-129d-41c0-a697-aad4f2ca1a01/jeep_service_around_me.pdf
    • https://b67fa923-03b4-4d21-b555-95ff628d7525.filesusr.com/ugd/1d4b90_a2d71e02816b434bbeb77d844e262930.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e6fcb3c3-922d-4217-8c94-d21392eb8876/tilegu.pdf
    • https://d872ce2a-2baf-4032-ab86-ab75b2f66d52.filesusr.com/ugd/338562_436085f2c3e24c68b12230efc5b84615.pdf?index=true
    • https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_ab2e24a12322441fa2c6c49b6eabb0e9.pdf?index=true
    • https://a581e706-3bf6-41fb-8978-ad4d4077590d.filesusr.com/ugd/afbe6b_d36ef1e3f05541f087b319e8ade8d304.pdf?index=true
    • https://e6343aec-df69-40e7-9959-3c0c55bf73c9.filesusr.com/ugd/6a9017_32404f4650364fd982fa9aa107122c64.pdf?index=true
    • http://wawebepibalura.epizy.com/les_autres_et_moi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f237.bin
0108d39cfa273dfcf38432a79d53f2ce85a488aaf81421211a13b6a03f37e6a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF237 5672 bytes
font_01_sfnt_off00010588.bin
6f08070018133b08f19d13912fb87f05b66f17d9ba719842009fe75a5b392b39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10588 11632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.