Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7b130c6c43e7619…

MALICIOUS

PDF

82.0 KB Created: 2021-05-29 01:04:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 04935f2f2b521ab22e6ccddd47dc0207 SHA-1: 69d2742c23f3cec1bd00ce0cd7b23faf12a79b97 SHA-256: d7b130c6c43e7619ef1cdfb75f0f175e20f7bec148c1dfd9b10d69e7206aa5f2
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan distribution attempt. The document contains a large number of external links, many pointing to other PDFs, suggesting a link farm or redirection mechanism. The primary URL, https://maypoin.ru/strik?utm_term=free+psd+church+flyer+templates, is likely part of a lure to entice users to click through to malicious content. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=free+psd+church+flyer+templates
    • https://cdn-cms.f-static.net/uploads/4499635/normal_6037f6055e052.pdf
    • https://gamekesilib.weebly.com/uploads/1/3/4/8/134892139/b313311d6601.pdf
    • https://koxewujinam.weebly.com/uploads/1/3/3/9/133986689/lipibizera.pdf
    • https://static.s123-cdn-static.com/uploads/4370286/normal_5ffab437445ad.pdf
    • https://lewaxirilukuxod.weebly.com/uploads/1/3/0/8/130813115/naxanukemuvizab-nimiburowipa.pdf
    • https://datezovog.weebly.com/uploads/1/3/0/7/130776229/fijizazakale.pdf
    • https://cdn-cms.f-static.net/uploads/4422638/normal_605bcbebd80bb.pdf
    • https://lefoxidegej.weebly.com/uploads/1/3/4/5/134526886/3223004.pdf
    • https://cdn-cms.f-static.net/uploads/4416494/normal_60584ae29d4f1.pdf
    • https://cdn-cms.f-static.net/uploads/4476007/normal_5fda02e7b3792.pdf
    • https://zemedabumudog.weebly.com/uploads/1/3/2/7/132712209/86795490.pdf
    • https://static.s123-cdn-static.com/uploads/4418781/normal_6006abd64fa2f.pdf
    • https://cdn-cms.f-static.net/uploads/4501501/normal_604112af5fb38.pdf
    • https://cdn-cms.f-static.net/uploads/4463830/normal_5fd8d2c2d97b4.pdf
    • https://xogepojofaridel.weebly.com/uploads/1/3/2/7/132741214/vufuritekexi.pdf
    • https://wuxejerupetumul.weebly.com/uploads/1/3/4/3/134341496/bizipulenuxu.pdf
    • https://cdn-cms.f-static.net/uploads/4482426/normal_602e1daa8ef9c.pdf
    • https://feravenokitaj.weebly.com/uploads/1/3/6/0/136095553/vopenukuripinitofe.pdf
    • https://direfuxapiw.weebly.com/uploads/1/3/4/3/134371974/jumatas.pdf
    • https://tedowinoni.weebly.com/uploads/1/3/5/3/135304389/a358639b704.pdf
    • https://cdn-cms.f-static.net/uploads/4386822/normal_601b6c8714d81.pdf
    • https://wigikeketiru.weebly.com/uploads/1/3/1/4/131406435/remifixuwubakobela.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9b0.bin
768295eab1fdbed9f6f4cbfbeaf643af1011964b9aeecf937ca523b4d07d1838		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9B0 5452 bytes
font_01_sfnt_off0000fc1a.bin
8ad618a7bbf9663e98789e4c0ec10f308213b8f5755d4c3af2cf206c30c1481b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC1A 11680 bytes
font_02_sfnt_off000123e8.bin
5bfda07072dd2e1b0df7f1680a75ba616774ec51e1a09c257f000ba239241e1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123E8 16140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.