Malicious PDF — malware analysis report

Static analysis result for SHA-256 f77b945e6fff0086…

MALICIOUS

PDF

73.5 KB Created: 2021-03-15 08:51:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b0cdf1bc1c8bc2749349fe1e0216dd2e SHA-1: 6194d5b1c9707d5a8d3696769fb01dcff5cbf38c SHA-256: f77b945e6fff00867746be981b0311402f3dd4ac8a62dc1a170b52d0af596561
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is classified as malicious, exhibiting characteristics of a phishing or link farm attack. It contains numerous external links, with a primary suspicious URL pointing to 'jottigo.ru'. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of embedded links, suggesting an attempt to manipulate search engine results or direct users to malicious content. While no scripts were explicitly extracted, the presence of external links and the ML classifier's high confidence score support a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • PRC/3D content in PDF medium CVE related PDF_PRC_3D
    PDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=winplus+car+jump+start+manual
    • https://nizevamil.weebly.com/uploads/1/3/2/8/132814567/rufufoxetofeni.pdf
    • https://static.s123-cdn-static.com/uploads/4383295/normal_5feb3805c8e56.pdf
    • https://bilimetib.weebly.com/uploads/1/3/4/4/134435282/2455802.pdf
    • https://rugexosijebup.weebly.com/uploads/1/3/4/0/134017508/8987092.pdf
    • https://static.s123-cdn-static.com/uploads/4367286/normal_5ff5b244a4f7a.pdf
    • http://sutivetowit.mypressonline.com/canon_powershot_sx700_hs_manual.pdf
    • https://jokasagumejede.weebly.com/uploads/1/3/1/0/131070006/2149179.pdf
    • https://cdn-cms.f-static.net/uploads/4393353/normal_5fd6c33bdb14f.pdf
    • https://cdn-cms.f-static.net/uploads/4459035/normal_6031f6f3e68af.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7d2ab5d8-319c-42f4-9ffc-b1642a939616/xolikixaluxamirajimupun.pdf
    • https://uploads.strikinglycdn.com/files/f245fcce-b0a3-48ed-9952-777a54c948de/59961750291.pdf
    • https://29aa9d28-cc9d-45fc-8d86-3718b5881c84.filesusr.com/ugd/74c34a_6a16b0fad45e4b859dc766d1c52f209b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/df2c6bd8-f1eb-4d54-81e4-a4e54ad6d737/14343143689.pdf
    • https://47ab6ce1-aee6-4086-a8e7-31fe393d2411.filesusr.com/ugd/afbef4_880a3bd27a4d4fc9a23578cea099c9e9.pdf?index=true
    • https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_c48a421b296748b496421ce467b74d96.pdf?index=true
    • https://c5c27394-2042-4749-9b39-d1c24dcbd9f0.filesusr.com/ugd/e9b987_c3d3dec2553348be84b4a21828f71c76.pdf?index=true
    • http://ligoroxenafof.atwebpages.com/18392514779.pdf
    • https://146c8b6c-0b46-450b-8ed0-b45f1e2a4974.filesusr.com/ugd/b58d21_6a75b481fbc84ba08b3ed740e8b7c160.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1e31187e-c67c-4ae5-b52e-0d15bfa06bf5/vaxin.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4af.bin
d74b713fd5f48ed10841cec047b656f1fa2f343bc8e2795551e4c2e81f15da9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4AF 5168 bytes
font_01_sfnt_off0000f640.bin
5bc8d350a472b85b4290bf655b57e0b45b60b433ffc400905d6eb30912becb1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF640 10188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.