Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6b82f02435eae3d…

MALICIOUS

PDF

70.3 KB Created: 2021-03-16 17:53:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1503175149ef7e9bde6c5c448c187a2e SHA-1: 20f253b098e46f269449d84c7b74b48bdf645ed8 SHA-256: f6b82f02435eae3d29f1e27dedfabcdbfdbc7ca9a1c465b80678dadc0f4ba921
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, pointing to various websites. The primary malicious URL identified is 'https://lozipotod.ru/wix?keyword=burnin+rubber+2+all+cars', which is likely used to distribute further malware or phishing content. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=burnin+rubber+2+all+cars
    • https://cdn.sqhk.co/wepevuwu/ggfgjQt/blueparrott_b450_xt_manual.pdf
    • https://gatepeduvemixif.weebly.com/uploads/1/3/4/6/134669895/nisix.pdf
    • http://vitrinachel.ru/ensayo_del_libro_el_arte_de_amar_erich_frommuevjg.pdf
    • https://sezifiloxoxo.weebly.com/uploads/1/3/5/3/135348424/mubafagisu_todediv_nezapomomofux.pdf
    • https://wawanuxofidote.weebly.com/uploads/1/3/0/7/130775818/4327245.pdf
    • http://honbiz.pro/craftsman_chainsaw_chain_sharpener1x9qx.pdf
    • https://cdn.sqhk.co/bureruverog/ftPjh2u/happy_room_log_hack_apk.pdf
    • http://artistichomesolutions.com/nepuwonibelemhupd5.pdf
    • https://kutesavakelex.weebly.com/uploads/1/3/4/3/134336058/2181501.pdf
    • http://tvoeobrazovanie.fun/gelatedolaxamemekjfom.pdf
    • https://cdn.sqhk.co/vawadawuleja/hjCnQgc/junior_graphic_design_jobs_nyc.pdf
    • https://cdn.sqhk.co/vefusujix/cihhfEF/xafodasufilix.pdf
    • https://cdn.sqhk.co/bomumuxa/hgUPahF/28066448671.pdf
    • http://remont-pc.website/ted_chiang_exhalation_bookshopefel7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5d706fa1-8db4-4ddf-8ba1-fa82c0307292/26867441607.pdf
    • https://s3.amazonaws.com/wulagisi/9026492674.pdf
    • https://s3.amazonaws.com/toguvaju/bewerapigikemafi.pdf
    • https://uploads.strikinglycdn.com/files/3d822e78-b6d7-4072-930f-45ec1f44c481/41676756726.pdf
    • https://uploads.strikinglycdn.com/files/3b15300e-ecc3-4504-8564-991ecbd112e8/why_does_my_rca_projector_keep_turning_off.pdf
    • https://s3.amazonaws.com/wegemebufojafak/63014254905.pdf
    • https://uploads.strikinglycdn.com/files/091af633-2868-4012-8707-cf515b3aeb1e/mokopotililixo.pdf
    • https://uploads.strikinglycdn.com/files/5c6f3ae8-b0fe-412b-948b-7f43f5dade76/nordictrack_act_elliptical_maintenance.pdf
    • https://uploads.strikinglycdn.com/files/c9a21558-124b-4d60-b8a0-1ee541dbcd09/madwoman_in_the_attic_quotes.pdf
    • https://uploads.strikinglycdn.com/files/2c95734a-0167-4e8d-b7c5-e8b4e076fe1e/97015848395.pdf
    • https://uploads.strikinglycdn.com/files/f06881cf-f92a-446d-982d-a0a21d7fba73/c_a_reference_manual_6th_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d58a.bin
3118fdce959a1bcb0167e0d9487a5c5a5e46b25426498485c4a71e204d4605b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD58A 5112 bytes
font_01_sfnt_off0000e6fa.bin
05ddc2f22f6fb54425041e57c889a6909e2fa6282eeb0f2e1b1e192f6ae87103		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6FA 10740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.