Malicious PDF — malware analysis report

Static analysis result for SHA-256 f15c01fc2f75877e…

MALICIOUS

PDF

76.9 KB Created: 2021-03-24 08:36:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d7526c7cea6cf9676c8b9737252132a7 SHA-1: 690fbf540aad8e0592a7db73fc4cb18a56f4cfa4 SHA-256: f15c01fc2f75877ef723af4be491c45c569ec539a62ed45557d104430704c44f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating it is likely a phishing or malware distribution lure. The document body, though heavily obfuscated, suggests a pretext related to an instruction manual. The presence of numerous external links, including one to 'pelibifir.ru', strongly suggests an attempt to redirect users to malicious websites. No scripts were extracted, but the PDF structure and link farm heuristic point towards an attack pattern involving user interaction to initiate a malicious download or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=farberware+air+fryer+toaster+oven+instruction+manual
    • https://cdn-cms.f-static.net/uploads/4481671/normal_601838398d7dd.pdf
    • https://cdn.sqhk.co/zixapegof/iejgije/aiou_duplicate_admission_form_spring_2018.pdf
    • https://cdn-cms.f-static.net/uploads/4474978/normal_60110b7dbfe9e.pdf
    • https://cdn-cms.f-static.net/uploads/4483335/normal_6050e65e405b0.pdf
    • https://cdn-cms.f-static.net/uploads/4388407/normal_601b356155eda.pdf
    • https://cdn-cms.f-static.net/uploads/4454977/normal_6033b79f35bdf.pdf
    • https://cdn-cms.f-static.net/uploads/4387050/normal_602507537c959.pdf
    • https://static.s123-cdn-static.com/uploads/4428342/normal_60032714ad22c.pdf
    • https://static.s123-cdn-static.com/uploads/4464527/normal_5fc7bebc9abac.pdf
    • https://cdn.sqhk.co/nedovipirumu/ggiacji/96067591553.pdf
    • https://cdn.sqhk.co/rovifatira/ijdrRD9/jamafipo.pdf
    • https://cdn-cms.f-static.net/uploads/4465257/normal_6047644029414.pdf
    • https://cdn-cms.f-static.net/uploads/4390095/normal_602e2e2cbd8cb.pdf
    • https://static.s123-cdn-static.com/uploads/4380869/normal_5ff9205d15db7.pdf
    • http://lipuwisapi.mywebcommunity.org/wogoritonigajaxo.pdf
    • https://cdn.sqhk.co/rajemaramiw/Whdhjgg/54785494946.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://levapoloj.onlinewebshop.net/78701023337.pdf
    • https://af30af13-e0b7-4de0-aca7-7783c01eade2.filesusr.com/ugd/9757e7_08702a4c7a384c5192f5da1f742237d1.pdf?index=true
    • https://6184de0c-c318-42a7-882e-c5ddc63b817d.filesusr.com/ugd/1c8c1e_6e75bcba63b64e6c8f8b60957a614171.pdf?index=true
    • http://ferodibev.onlinewebshop.net/79160549026.pdf
    • https://3f9320ff-391d-49df-b192-c557e211a93c.filesusr.com/ugd/469aea_b36e1e0192bc421c98a2b3f7ab6b16b5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee1b.bin
8cf32d9b1a8f973cc84e5b4b432761bf73e04a5d3daa0aa277af905288181744		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE1B 5376 bytes
font_01_sfnt_off00010071.bin
0b76076e1c312f432e566c0d8e56bdf35d12844e869ec6716affc9aa09647cdc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10071 11204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.