Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc53633a776b6ca2…

MALICIOUS

PDF

71.7 KB Created: 2021-04-13 06:47:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 16ff2857ab2e7985ce21b85b9097ca34 SHA-1: 299fbd16ba15754bb8b401edacf039c54c93b3e0 SHA-256: dc53633a776b6ca27d15b980aa887c17415f8179b392c78524f221b987a0662a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, suggesting a link farm or phishing attempt. The embedded content, though obfuscated, appears to be part of a lure to direct users to external URLs like https://xezojetit.ru/strik?utm_term=sta+rite+pool+supplies+near+me.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=sta+rite+pool+supplies+near+me
    • http://mosomupusafebin.medianewsonline.com/dulatafopufefivosawedunu.pdf
    • https://cdn-cms.f-static.net/uploads/4448345/normal_6032ae0c26ee2.pdf
    • https://cdn-cms.f-static.net/uploads/4374178/normal_606baa6906fad.pdf
    • http://famozosivupiwij.sportsontheweb.net/how_to_get_share_the_wealth_cards_in_life.pdf
    • https://cdn-cms.f-static.net/uploads/4490920/normal_605f9ded905ad.pdf
    • https://cdn-cms.f-static.net/uploads/4383582/normal_5fe9f8cb3a9a4.pdf
    • https://static.s123-cdn-static.com/uploads/4471091/normal_5ff4ffbcb2dd9.pdf
    • http://tadolonelo.sportsontheweb.net/nitrogen_generator_how_it_works.pdf
    • http://feludekinopotas.scienceontheweb.net/93803357849.pdf
    • https://cdn-cms.f-static.net/uploads/4371240/normal_602084eb6af57.pdf
    • https://cdn-cms.f-static.net/uploads/4419206/normal_602f44860e3ab.pdf
    • http://potuxoposutu.medianewsonline.com/cornerstone_chords_key_of_g.pdf
    • https://static.s123-cdn-static.com/uploads/4479718/normal_5fe304caa7d2b.pdf
    • https://static.s123-cdn-static.com/uploads/4366339/normal_5fcd04d6a441a.pdf
    • https://cdn-cms.f-static.net/uploads/4450426/normal_601b78ab6290e.pdf
    • https://cdn-cms.f-static.net/uploads/4394082/normal_602b862daf710.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b147a2f3-58af-4013-9def-597e86e94513.filesusr.com/ugd/47d6bb_f26a969b073749d7877c8b35dda78202.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e4374883-09a9-4a88-828b-9aeaea061469/3624797582.pdf
    • https://uploads.strikinglycdn.com/files/472fd753-6d0b-4b80-9252-d56d47298f37/siriwesokanudujofawigiti.pdf
    • https://bea00909-aa88-4d38-ac88-e56db460b486.filesusr.com/ugd/923104_50179e949e1d487bbb705c36cd5ecd72.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a9f7adb3-2f9f-49ab-aef3-1c5ed3d440e1/what_are_the_current_statistics_on_diabetes_in_america.pdf
    • https://73af689e-4c80-4f62-99d3-7a886641ad81.filesusr.com/ugd/3b5dd9_75726a99c7fb44e2ac7a12876dd0329f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/aaa51e4c-c710-4209-b3e8-17bec964572e/hamilton_beach_toaster_oven_air_fryer_31323.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000daa7.bin
413f7cdc742be3091a1d6562f955c78ca6b6af482acbdea64d67720f849b3410		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDAA7 5068 bytes
font_01_sfnt_off0000ebc8.bin
b970cad6d06142957a8f02387174adda26f5d154bd75abdf3d75bc28c466ad50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBC8 11052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.