Malicious PDF — malware analysis report

Static analysis result for SHA-256 05bff463cfc4e8d3…

MALICIOUS

PDF

81.8 KB Created: 2021-04-29 08:15:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab7d41011afc9a9274a65185e9dfc298 SHA-1: db642313863e3d5ea889b5d91a5d827ce2789bb0 SHA-256: 05bff463cfc4e8d34c1b0fd46185857e3b09751a025fad608e53cf1aa1bba973
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one prominent URL leading to a suspicious domain. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as a phishing trojan. The embedded content, though heavily obfuscated, suggests an attempt to disguise malicious activity under a common topic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=what+sins+are+unforgivable+in+the+bible
    • http://shopbest.online/baal_veer_1100_to_12007op1x.pdf
    • http://crubr.space/watch_crank_2_onlineyqsy7.pdf
    • http://apeech.ru/49931208651b7jmo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/galinikagopit/write_a_newspaper_report_on_flood.pdf
    • https://s3.amazonaws.com/zuwosil/jitavavodijonuxulodatat.pdf
    • https://e3e1c2aa-7f41-47b0-8c2f-d823cb48b857.filesusr.com/ugd/7598fa_d8ccb12127fe4e07a6af73748cf1c6af.pdf?index=true
    • https://s3.amazonaws.com/werowibovezoje/un_enlace_covalente_polar_se_forma_entre.pdf
    • https://a001dc82-f31e-4944-9b76-0a8e602b6855.filesusr.com/ugd/e4ee87_d5f877f525144a47b9918367ac404244.pdf?index=true
    • https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_9c5dff331e814f4bbc1fedbc2e315b81.pdf?index=true
    • https://144ece88-722e-4d59-a9d1-ae16887514c2.filesusr.com/ugd/48b17f_357ab00641a14a8d95a8430c09c05cc9.pdf?index=true
    • https://s3.amazonaws.com/fumiposamisur/cat_meme_and_another_things.pdf
    • https://s3.amazonaws.com/rujimidujek/can_you_use_a_cool_mist_humidifier_without_the_filter.pdf
    • https://ecab545c-19d2-4654-b6ac-fb8b9749f5ba.filesusr.com/ugd/e5412a_9688854fa3c34437a90f0058596104fe.pdf?index=true
    • https://77bac38d-831a-46d6-8f22-d7743fcadc58.filesusr.com/ugd/5b9a87_9068b173e280491f86dc91e3986933a7.pdf?index=true
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_73ed3baf26ca4735bd565323dce31a17.pdf?index=true
    • https://ca7c05ed-d233-4774-9cf9-08ff86aa6c73.filesusr.com/ugd/b42fd6_ec53c232e0ea43b7bb460084fc1e3563.pdf?index=true
    • https://5e0c4d4d-41f9-428c-9564-b93e7cff6769.filesusr.com/ugd/510691_c78864c5f6174ee48e20dd962e33f0e0.pdf?index=true
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_537a7ccbb6d543fea714ce4eaf2c40dc.pdf?index=true
    • https://50c84cdf-c8d4-407e-a307-361b94491100.filesusr.com/ugd/f2656e_ab86b4d5c3aa4c51b9b94a91c0ae12e4.pdf?index=true
    • https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_20d4dcde55c240aca2d6edd12a3e3485.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101d7.bin
91e0b1e315c2c6cc2056861dcdeae342384169448e6d7979bf2269137bf6baef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101D7 5240 bytes
font_01_sfnt_off000113bd.bin
22d7ff2bf942a0c11cbe354da807641e8e9e5288821fb9d951cfcf7629fda6b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113BD 11172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.