Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbb7a646155054ca…

MALICIOUS

PDF

75.4 KB Created: 2021-05-27 11:17:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 4df50c540f7a7a3c220320cbb49383e7 SHA-1: 568d0838274964d407de3647b322de90e5da75db SHA-256: fbb7a646155054ca505b8baaaa5d079250c1b074bc38bde0c7e013de1340a875
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a link farm with 30 external links, many pointing to disposable hosting, and one primary malicious URL: https://jottigo.ru/strik?utm_term=my+tom+mod+apk+revdl. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure suggests it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=my+tom+mod+apk+revdl PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4464301/normal_5fe695491a393.pdfIn PDF document text
    • https://xolitosoxi.weebly.com/uploads/1/3/4/5/134583661/furumek_kedijoreta_wumafumuzu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402246/normal_5ff7b0564f589.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371509/normal_60371663cbd8c.pdfIn PDF document text
    • https://fakavenudir.weebly.com/uploads/1/3/4/0/134042443/babakatizipemu_pexosekixoguzu.pdfIn PDF document text
    • https://josuzowonuni.weebly.com/uploads/1/3/4/6/134685096/9c47c88.pdfIn PDF document text
    • https://nabapobu.weebly.com/uploads/1/3/7/5/137501246/gapebulobodud.pdfIn PDF document text
    • https://referozudu.weebly.com/uploads/1/3/0/7/130775612/jekavixavotibune.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/912de640-66ae-4e42-9490-1071747bb6f8/wuvemeviw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5dc27d22-6b1f-4271-9493-017293f2b974/jopimipejozeduna.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6103cb70-457b-42cc-b00a-0bb13e4ea2e8/kixelirabuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68484d87-98ab-4951-9580-f21cdb91ed25/lizozexa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6da3d370-4b7a-4f40-927c-8d3d220e2864/best_multiplayer_survival_games_pc_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa84f12c-94b5-4305-9ff4-796d939c071f/sufixadobajutikul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6993bcc0-cb66-4cf2-af25-0553fd8b2304/pidixurebukofepaxu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df17db05-7258-4859-82b1-e4ea477edf4d/goebbels_diaries_archive.org.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1975865f-4250-47d8-8963-9da33f7da7c7/3916207193.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b942acd9-961e-4c76-8d86-3e653b0a4e55/96554803617.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c98f77f-ed77-4736-8afd-f1bc6e76554f/ziwasugagi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9a11a8c-efd4-47a4-85e1-7227f8322985/whats_a_good_way_to_start_an_essay.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/688c1e5e-9976-4298-8862-98a274c0b040/what_is_a_diverse_learning_community_gsu_hold.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82bb6363-555e-4698-8863-75f9d4906d31/the_disaster_artist_radnja_filma.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5e72100-bd02-4ac3-955d-a52d64f71b07/class_paul_fussell_quotes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebcc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBCC 5156 bytes
SHA-256: ddeee842e12b2be6ae74834c8a0f536675ddfb86c45e3a7f83fe95b81981dde0
font_01_sfnt_off0000fd59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD59 10128 bytes
SHA-256: 3e3b5762774000e098756f066258708e595320558e5716eb8afcecc0acc5d38f

Open this report in the interactive analyzer, or submit your own file for analysis.