Malicious PDF — malware analysis report

Static analysis result for SHA-256 d63872c6dc0abd72…

MALICIOUS

PDF

96.9 KB Created: 2021-05-05 15:14:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 19650d7fd5ab25cbf5f686c878e89bbd SHA-1: 581e7c2f6ed5d170835b2ad8884212fe2dd9e4ab SHA-256: d63872c6dc0abd72cd56a38883eadbb1306e1237010d551489d531f2bb8ed0c8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing document with a link farm, and it was flagged by a machine learning classifier and ClamAV as malicious. The document body, though heavily obfuscated, suggests a lure related to a 'Sullair 185dpqjd parts manual'. The primary IOC is the external URL which is likely used for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=sullair+185dpqjd+parts+manual
    • https://cdn-cms.f-static.net/uploads/4447915/normal_6059f1a754dd5.pdf
    • https://gepogujewo.weebly.com/uploads/1/3/1/3/131382217/a4c573dd6d.pdf
    • https://rowafitiw.weebly.com/uploads/1/3/4/6/134608100/wonabagig.pdf
    • https://cdn-cms.f-static.net/uploads/4460263/normal_6065767cc1913.pdf
    • https://zozizifubigidoz.weebly.com/uploads/1/3/1/4/131409074/fibudig.pdf
    • https://lavovozanu.weebly.com/uploads/1/3/0/7/130739022/pirofoz.pdf
    • https://cdn-cms.f-static.net/uploads/4427267/normal_60526ee65ad92.pdf
    • https://jinidodax.weebly.com/uploads/1/3/0/9/130969434/72c9af10128a51d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://f5071db7-799c-4807-8cfa-c66b012f33b1.filesusr.com/ugd/9a4546_f685920c538c4c3f8e36bb890a1fed40.pdf?index=true
    • https://c7bff75e-0a19-4817-9d47-fca4cf08161b.filesusr.com/ugd/3b6424_0cf6a81020cd4cca97829d6b6dee12ae.pdf?index=true
    • https://0cc2a7d0-6f33-4335-9ec9-554d9418487e.filesusr.com/ugd/cb4a18_90100e0623fa441b82f06f05a1b6a4ff.pdf?index=true
    • https://42e65457-ec34-4553-8979-78b6e302f774.filesusr.com/ugd/f1976d_b07ccb2608d541c6bee724a4c71ced2f.pdf?index=true
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_c679c4f08c934212b7cf428442a07a7d.pdf?index=true
    • https://88e92b2d-3ddf-41b2-a2ae-4af48bfba274.filesusr.com/ugd/b74686_0fad18d19f484fbb96964769dd4c10c5.pdf?index=true
    • https://de99934f-f465-4d69-af5e-14f317c0a7c6.filesusr.com/ugd/4fea5c_cd21c0c6949247e4aa01d108ba8ab5d8.pdf?index=true
    • https://4694dce0-4d1e-4c77-b4da-d1f025f82355.filesusr.com/ugd/fb332b_f7e8386be50b4543ae590a1e8e107f53.pdf?index=true
    • https://5b949be5-44ef-49af-96c7-0ebaa8fe632e.filesusr.com/ugd/3402b1_c56f6164fcea40df835d5b2a17776887.pdf?index=true
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_8daed3674f704913b5767038d65fe47d.pdf?index=true
    • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_00fcdf9689c14fb3a143633cbc609ae1.pdf?index=true
    • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_a152e19ec67c4e2a8ca48d6f9c3fabb5.pdf?index=true
    • https://s3.amazonaws.com/winumigutam/fowubewukafizititofafota.pdf
    • https://s3.amazonaws.com/defipedibe/18057921985.pdf
    • https://994180ce-385f-4272-9833-4a204a825e0f.filesusr.com/ugd/ec0c41_9c05ef18e5b8417489095fb95eaabc24.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012f9e.bin
a1aad7a97b3a2ae324359f04eaa997d772ae300a8aaae79910234006722e5ac4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F9E 5432 bytes
font_01_sfnt_off000141ef.bin
c4b3d588f3e4c835ddbbd4783d5e7b24338f58a5a257b8132e951c0b2a42d491		 pdf-font-stream PDF embedded font (sfnt) at offset 0x141EF 11128 bytes
font_02_sfnt_off000167fa.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x167FA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.