Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbad06a5dc5c80d2…

MALICIOUS

PDF

79.4 KB Created: 2021-04-02 00:11:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4b8f483d62c18d8fbcba26150bff36d9 SHA-1: ee1b44e4ded3dc73232a0f4540ebe866deddca36 SHA-256: fbad06a5dc5c80d2dc39338c2035819031a4a1c2d10ef89bab570b658ec3589a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is part of a link farm, with numerous external links. One prominent URL, 'https://lozipotod.ru/award?keyword=bearing+capacity+of+soil+pdf+download', suggests a phishing or SEO manipulation tactic to drive traffic to other sites. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely to distribute further malware or engage in phishing activities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=bearing+capacity+of+soil+pdf+download
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4909b19c-2171-4603-be2b-1a50d9cbf8bf/lock_pick_set_for_sale_pretoria.pdf
    • https://bfb79b04-db4d-4c54-a74a-4733ff68ceb9.filesusr.com/ugd/11291b_975cadb0994240cca0a44e3c55f147ab.pdf?index=true
    • https://ee60c613-3dd1-430d-b711-08e3dcbf0273.filesusr.com/ugd/19ce5d_b72105ff4f8d47d6bd3064f583075e18.pdf?index=true
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_79ec891cdcad40af8d14baefce26a37b.pdf?index=true
    • https://fb7bf4c5-056f-4058-a7d1-073478569b53.filesusr.com/ugd/d90490_5f4239eceeef49fca3af915f536daeb4.pdf?index=true
    • https://d04c2b29-3777-4fe6-aaa9-ab96f87c3324.filesusr.com/ugd/43eb95_1edcff253df8482c86ef6403e30af65c.pdf?index=true
    • https://s3.amazonaws.com/jixeremipet/adobe_photoshop_elements_2020_free_trial.pdf
    • https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_9b30497d502244b3a0bcf890d5772b8b.pdf?index=true
    • https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_f2ce2689de814effa8c0b7a49431f9cd.pdf?index=true
    • https://9d349da1-218b-4b59-9e37-2a90cab56d40.filesusr.com/ugd/de9003_5c6eed343b1e493ab9d1c8aeba784c51.pdf?index=true
    • https://0f0532cb-4478-41f9-91a1-cf277c4732ec.filesusr.com/ugd/8acad3_d8231f121f3c43d2ad536c0722599f31.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0150a859-12c0-46df-bf40-d67540744bdd/7th_grade_science_reading_comprehension_worksheets.pdf
    • https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_16625284d17448058ebe40eb266ba7fe.pdf?index=true
    • https://s3.amazonaws.com/fedufiporara/99300267205.pdf
    • https://uploads.strikinglycdn.com/files/8cbaf58a-6a16-4fa0-999a-c80a9f908955/48734373886.pdf
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_36ce35153896467e9e9bdce6fc7b6e72.pdf?index=true
    • https://s3.amazonaws.com/bezorito/rebusibafezunulo.pdf
    • https://uploads.strikinglycdn.com/files/55a6f964-7ef3-499f-8b73-03a0610b641e/83355436103.pdf
    • https://uploads.strikinglycdn.com/files/51030d3c-e5c8-42b3-9c1d-a5ea811ccb8e/torojogojewevezenugow.pdf
    • https://uploads.strikinglycdn.com/files/d524d787-14a8-4d91-be90-fb5c15e0d0ae/made_to_stick_chip_and_dan_heath_summary.pdf
    • https://8ecf7690-1f99-4e28-a4b6-3228ba9731d7.filesusr.com/ugd/63d3ad_1d02ea1d43f248448a8ad440be8b194c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0820e1b4-1dc4-4797-a5ff-ac5f7da580c7/fl_studio_11_hip_hop_plugins_free_download.pdf
    • https://s3.amazonaws.com/zisulamisozoto/the_revenant_bear_scene_explained.pdf
    • https://d4bcd744-2348-4fe3-9006-05b2fcbd3cbd.filesusr.com/ugd/704566_ccc51e79cfbd4b5893f88cf9dc88d529.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed1a.bin
24639c9dff8861c7fa6f86359790fd6021db0dbf7745d9d5d7f16f19575a0a88		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED1A 5564 bytes
font_01_sfnt_off00010038.bin
3c06f75c17e40ceed5a07392b37091f529246df15a51490eb3c6e9acd74d0d2f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10038 14864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.