Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6e25542c331767e…

MALICIOUS

PDF

80.6 KB Created: 2021-06-02 12:54:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c83ca707a66413ed42703a288111232 SHA-1: 74bcab0ca9af591b25527d40c6dfe5d667ac98e6 SHA-256: f6e25542c331767e29c4ba37638cdbb6b3b9a92bc2a85d02a22ecac42cf57b7b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm. The primary malicious URL, 'https://gimoguvi.ru/123?utm_term=minecraft+chiseled+me+mod+1.+12.+2', suggests a lure related to a Minecraft mod. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=minecraft+chiseled+me+mod+1.+12.+2
    • https://soxajenukaru.weebly.com/uploads/1/3/0/8/130874283/858c0ace15a3f9.pdf
    • https://valuluxunu.weebly.com/uploads/1/3/2/7/132710491/8514475.pdf
    • https://jirozonuk.weebly.com/uploads/1/3/1/6/131606844/e6370523a35cd84.pdf
    • https://vutuwoti.weebly.com/uploads/1/3/4/7/134720014/rebofarenizef-lojomaliketaneb.pdf
    • https://manovofaripoluf.weebly.com/uploads/1/3/1/4/131453531/7342972.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d3816b33-2735-432f-8d32-c6b05eb43910/29865403336.pdf
    • http://beratirupo.pbworks.com/w/file/fetch/144493542/miracle_frp_tool_thunder_edition_v1_02_cracked_2018_full_work.pdf
    • https://uploads.strikinglycdn.com/files/1ffc4904-616f-44ef-868f-db8025c77680/pugiguwezal.pdf
    • http://paderukut.pbworks.com/w/file/fetch/144451356/70732768582.pdf
    • https://uploads.strikinglycdn.com/files/c53ee4ec-95ce-4253-a9ab-49712c33a727/bose_companion_2_series_iii_multimedia_speaker_system_pc.pdf
    • https://uploads.strikinglycdn.com/files/20f41aa2-bb27-46ee-b71d-7307f4717661/zukikapojipunasuj.pdf
    • http://mukibilevejo.pbworks.com/w/file/fetch/144472257/how_to_connect_jbl_flip_5_speakers_together.pdf
    • https://uploads.strikinglycdn.com/files/773ac614-d2ae-4dd9-a220-e6934308f81d/uc_browser_latest_version_free_download_for_android.pdf
    • https://uploads.strikinglycdn.com/files/86c7af70-58d3-43dd-b95b-070d06497898/learn_arabic_pro_apk_free_download.pdf
    • https://uploads.strikinglycdn.com/files/0e424d0a-3b54-4d4b-b70e-38f7f2b45a9b/french_verb_vouloir_conjugation_chart.pdf
    • http://funuvutidip.pbworks.com/f/lodunelevafuranuvijuf.pdf
    • http://kikipudojuzo.pbworks.com/w/file/fetch/144500961/ielts_reading_practice_test_british_council.pdf
    • https://uploads.strikinglycdn.com/files/499b8dc7-4725-4579-87ea-a4e7cb2eab88/rixalexutagudedobe.pdf
    • https://uploads.strikinglycdn.com/files/7baf9ef5-59d4-417b-9bd5-32db8f924a93/rujukom.pdf
    • https://uploads.strikinglycdn.com/files/c8fe3bf1-3708-4a91-a1fb-7120fcbf8fed/angelcare_soft_touch_bath_support_-_aqua.pdf
    • http://giwupiraride.pbworks.com/f/harbor_breeze_remote_battery_keeps_dying.pdf
    • http://nuxawakaxaz.pbworks.com/f/conjugate_acid_base_pairs_chem_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/2f111748-645d-464c-8b1f-628e64a47efd/how_to_get_child_tested_for_sleep_apnea_at_home.pdf
    • https://uploads.strikinglycdn.com/files/0194eb47-09bb-4b8a-b626-39146eb70461/motebafogokuzuki.pdf
    • https://uploads.strikinglycdn.com/files/0cf8c246-8784-4e23-9809-f1fa2e7a8fcc/4190673310.pdf
    • https://uploads.strikinglycdn.com/files/3bb196fb-18e1-4a86-9ac5-191bee8a4ab3/45980735652.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f420.bin
4601cd48d1811ca8d94aed875878bc9e75b73fbe576c35d689bb538b80ee09e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF420 5484 bytes
font_01_sfnt_off000106af.bin
3b2cc1106f38c300e4ccf01ccc864cbd3a29648aaa0316960ae8e09d6004f3d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106AF 14512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.