Malicious PDF — malware analysis report

Static analysis result for SHA-256 e01b55dbec2ee77b…

MALICIOUS

PDF

74.9 KB Created: 2021-03-15 06:44:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 496d6c077c5f3583aff801d95cc9d74f SHA-1: 0eb94a368814085cde89d8d65623a0d5ae4ac0e2 SHA-256: e01b55dbec2ee77b39fc57440aa7eb6219f4809975581d0476330509b20c79df
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file functions as a link farm, presenting itself as a search result for 'mental math worksheets grade 7 pdf' to entice users to click on numerous external links. The primary malicious URL identified is https://lozipotod.ru/award?keyword=mental+math+worksheets+grade+7+pdf. The file was flagged by ML classifiers and ClamAV as a phishing/malicious PDF, indicating a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=mental+math+worksheets+grade+7+pdf PDF link annotation
    • https://dagolitufewanat.weebly.com/uploads/1/3/5/3/135345669/mijepunur.pdfIn PDF document text
    • http://quinzsy-studio.design/birthday_audio_songs_in_telugu_freejisso.pdfIn PDF document text
    • http://becloud.website/basic_english_worksheets_ks3_for_freewsnw2.pdfIn PDF document text
    • https://jurujixomegisi.weebly.com/uploads/1/3/4/7/134745805/zadolixegujofatu.pdfIn PDF document text
    • http://bajesiradevo.getenjoyment.net/23157598107.pdfIn PDF document text
    • http://wotedogupowu.sportsontheweb.net/oppo_bdp-105d_usb_dac.pdfIn PDF document text
    • http://pakunobun.getenjoyment.net/76230784860.pdfIn PDF document text
    • https://laziboxejebemu.weebly.com/uploads/1/3/0/7/130740401/1794773.pdfIn PDF document text
    • http://lenugaguv.medianewsonline.com/center_parcs_sherwood_activities.pdfIn PDF document text
    • http://mebotus.mypressonline.com/tebazubow.pdfIn PDF document text
    • http://keluzizizeroki.getenjoyment.net/9104940682.pdfIn PDF document text
    • http://betmoy56.com/34503292413e1nno.pdfIn PDF document text
    • https://memibufosigi.weebly.com/uploads/1/3/1/3/131383384/7434294.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://e5447efa-8854-4d04-834e-f0bbd7438c8b.filesusr.com/ugd/ac612b_e542fa3c764d4af585f70a850bfc9532.pdf?index=trueIn PDF document text
    • https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_3ab2a75508be4d7f989d9c6506f39794.pdf?index=trueIn PDF document text
    • https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_938f446b2edd4244819d46456998e0b7.pdf?index=trueIn PDF document text
    • http://nununad.myartsonline.com/82202931051.pdfIn PDF document text
    • http://jimomurapujivo.onlinewebshop.net/kewuzuna.pdfIn PDF document text
    • http://bavufupuvamopaf.atwebpages.com/ielts_speaking_topics_part_3_with_answers.pdfIn PDF document text
    • https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_8597ce3650b54ada9d6de2fc78d3f54e.pdf?index=trueIn PDF document text
    • https://87da31d5-d184-45e7-a456-0ad082c8bd65.filesusr.com/ugd/55e94a_cdeace79703140fdacaec764294f974c.pdf?index=trueIn PDF document text
    • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_e7ad41bf6421468aa3523ff30f2aa32a.pdf?index=trueIn PDF document text
    • http://lojubefogugiku.onlinewebshop.net/3d_maker_for_nx.pdfIn PDF document text
    • https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_c0beaebd8a1841c5ad5529adcdaa8d92.pdf?index=trueIn PDF document text
    • https://f0198b83-f3fe-41b4-8315-bacd7eabb238.filesusr.com/ugd/2b3f46_21d2b60b3c964a9584f3492dac48fe9b.pdf?index=trueIn PDF document text
    • https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_8adbe0235ef247b09e3513a164241dc2.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED2A 5696 bytes
SHA-256: 61bcbc32c7dc4abcbe2d19c95ae8add02f04a545415a86e8e730586a279f21de
font_01_sfnt_off00010091.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10091 10824 bytes
SHA-256: 0974a92c5157da5103a6c2275d3bfa5cd949ecff00231fe73377f9f373f4b5af