Malicious PDF — malware analysis report

Static analysis result for SHA-256 05e424a037c50b3b…

MALICIOUS

PDF

84.9 KB Created: 2021-03-18 10:20:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ddfca1c36a024c0739ac09e6c306059 SHA-1: eb4694b2877611b35307c207ffc2cb37607a24bb SHA-256: 05e424a037c50b3b925ebd04370459d528f9940991560acef87f8bf4f506310d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The primary external URI found is https://bologen.ru/wix?keyword=kitchen+nightmares+the+greek+at+the+harbor+dailymotion. The ML classifier and ClamAV detection strongly indicate maliciousness, likely related to phishing or malware distribution through these linked resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=kitchen+nightmares+the+greek+at+the+harbor+dailymotion
    • http://nefuzixitelu.iblogger.org/android_studio_emulator_no_internet_access.pdf
    • https://cdn-cms.f-static.net/uploads/4454172/normal_6033de2b544df.pdf
    • http://slimitalia.space/fisanulazutefeves43zz4.pdf
    • https://bopiwode.weebly.com/uploads/1/3/4/3/134367631/b7a32bb.pdf
    • http://parralax.net/pupen5izaf.pdf
    • http://tefulen.iblogger.org/91773254875.pdf
    • https://cdn-cms.f-static.net/uploads/4417141/normal_604a56e295f47.pdf
    • https://cdn-cms.f-static.net/uploads/4465559/normal_603593c968369.pdf
    • https://fatajoser.weebly.com/uploads/1/3/4/6/134655124/6613781.pdf
    • http://all-casino.xyz/mofumid6zsst.pdf
    • https://gidupewurugi.weebly.com/uploads/1/3/1/6/131637306/zavorafajekafu.pdf
    • http://zarabatyivat.ru/how_to_reset_a_stairlift2wx53.pdf
    • https://zuvopiramalatug.weebly.com/uploads/1/3/5/9/135981479/667972.pdf
    • https://cdn-cms.f-static.net/uploads/4457854/normal_5fd5fac375c88.pdf
    • http://hook-up.fun/mackie_profx8v2_pa_mixer_with_fx_and_usb_4_channel3kadw.pdf
    • https://cdn-cms.f-static.net/uploads/4420767/normal_60349eee9a566.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://bdc3fad0-85dd-4e34-85f7-620d54d4ff6f.filesusr.com/ugd/10cedf_a1d93f8a46e94c45b9f6dcaae5a7449c.pdf?index=true
    • https://9e77dbea-16d6-438e-9859-4a68c5388828.filesusr.com/ugd/3225da_574e133f8ba346c2b1b6e8e1d6fe6234.pdf?index=true
    • http://xirugole.epizy.com/diet_and_workout_plan_to_lose_weight_and_tone_up.pdf
    • http://retejades.rf.gd/27672106803.pdf
    • http://lafatakijuton.epizy.com/novavozefaberewobaf.pdf
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_05483fe2350e4cb7bfbb04a1dd8eeaae.pdf?index=true
    • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_5c41d0ef26aa485d9557a6ac8223b095.pdf?index=true
    • http://zividovapajawuv.epizy.com/international_acid_rain_information_center.pdf
    • http://bipulusesag.epizy.com/the_power_of_now_author_eckhart_crossword.pdf
    • http://reduxaxu.epizy.com/27961145349.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010acd.bin
e083ab60d7e35916d43716922f150c01d4b3e9db74758b1649e8db2a6de451fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ACD 5628 bytes
font_01_sfnt_off00011dc8.bin
75a5d6c8af224aca39fce0baa3d4f2f65cb448e8ba9b7a44185f6c4a95038e90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DC8 12004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.