Malicious PDF — malware analysis report

Static analysis result for SHA-256 f316b75d07035cb5…

MALICIOUS

PDF

83.6 KB Created: 2021-05-08 07:41:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 184ba6a5d8d764c0152eeda0489a4080 SHA-1: fc5282e84fed657a5133c59faa9e9071946b7347 SHA-256: f316b75d07035cb5d7b145660876b86c87f92a25a068ac3a11b0e8a78d60ebd3
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous embedded URLs, many of which point to disposable hosting and are used in a link farm pattern, suggesting an attempt to obscure the final malicious destination. The primary URL, https://jumiwimov.ru/strik, is presented with a search query for a popular TV, likely a lure to trick users into clicking.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=sony+32+inch+led+hd+ready+tv+%2528klv-32w622e%2529
    • http://italylife.pro/fetirakagijoxuwtfy5m.pdf
    • http://xtreme-sport.ru/what_do_vegetarians_eat_to_lose_weight56ljw.pdf
    • http://onlineeshop24.xyz/xbox_cloud_gaming_controller_clipgaz48.pdf
    • https://nelizozab.weebly.com/uploads/1/3/0/8/130874358/6008522.pdf
    • https://rusokakes.weebly.com/uploads/1/3/4/0/134016884/sotumemizisew.pdf
    • http://gufufisazikoja.iblogger.org/62069903319.pdf
    • http://netusikofigo.22web.org/dmvpn_config_guide.pdf
    • http://fosuxevudutuviv.22web.org/rajoga.pdf
    • https://namoxatiki.weebly.com/uploads/1/3/4/4/134477177/sefigalizovu-mopupewewataro-jofed.pdf
    • https://vofamebibefa.weebly.com/uploads/1/3/4/6/134694090/vinijepugadevof.pdf
    • http://roskycnmx.com/nosupilaxidigymla.pdf
    • https://tufezojaf.weebly.com/uploads/1/3/1/3/131384552/dosoredodotik-nifobetu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lijilivini.epizy.com/getibojime.pdf
    • http://duzunop.rf.gd/the_jesus_mysteries.pdf
    • http://zogemidagubaro.epizy.com/46340224261.pdf
    • http://witivovubujo.epizy.com/counterparty_credit_risk_and_credit_value_adjustment.pdf
    • https://uploads.strikinglycdn.com/files/03efe58f-951f-40c7-ab73-8e24c76ebe04/19249511233.pdf
    • https://uploads.strikinglycdn.com/files/de3ec943-d0e8-4a86-b014-ee388d4f9b46/the_boarded_window_discussion_questions.pdf
    • http://nofoforom.epizy.com/60003032196.pdf
    • https://uploads.strikinglycdn.com/files/4321e529-f415-4bca-8480-6017134d1668/how_to_knit_bed_socks_for_beginners.pdf
    • https://ffb80149-315c-4936-8637-e87477b606fc.filesusr.com/ugd/e7410d_2e27caf4e0514812844728c5515c2f89.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6e3e1ac0-baf9-42a1-962a-3f4b851e56f1/whats_a_man_of_the_house.pdf
    • http://jemekovivokuvup.epizy.com/83260330337.pdf
    • https://d872ce2a-2baf-4032-ab86-ab75b2f66d52.filesusr.com/ugd/338562_eef026d0ea5a4766b7f2ff609e877bf6.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2adfd90d-667f-4df8-97d6-c3cb5158e832/how_long_does_it_take_for_i-130_to_get_approved_for_mother.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee8a.bin
ff5341ae580685599d428706197ec20b5f582b2cbb61729f92ede24c0a1a6e37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE8A 5908 bytes
font_01_sfnt_off000102ce.bin
ebf7b17b347cc35a85bf13413c30a9fa7f5c1a2f45acd7f9edd59fa4f6535f8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102CE 11056 bytes
font_02_sfnt_off000128c5.bin
c84008f6d8fd1be40b1cd65f6a8e84d4f5de8674e59d729c0e3cc5207901215b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128C5 16224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.