Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a05e2750dc456b4…

MALICIOUS

PDF

78.9 KB Created: 2021-04-04 14:33:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f525341cd6be72ca54913bb0507bc4c8 SHA-1: e5ba48eb6cdad873b2f87466875b8270622801c9 SHA-256: 5a05e2750dc456b42c6ac631d87f539081143c777b2906d8afb6a1891cc1eedc
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous external links, including one pointing to 'jumiwimov.ru', suggesting it's part of a link farm or phishing campaign. The document body, though heavily obfuscated, contains text related to 'dark souls rings amazon', likely a lure to attract victims. No scripts were extracted, but the PDF structure and numerous external links are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=dark+souls+rings+amazon
    • https://cdn.sqhk.co/mezutowede/4Kdiba1/41086969692.pdf
    • http://xewokilazutir.iblogger.org/wasodizifasujeva.pdf
    • https://cdn.sqhk.co/detatakev/ggeS7kG/livil.pdf
    • https://cdn.sqhk.co/lafixafif/jckM7gj/fantasy_premier_league_gameweek_5_tips.pdf
    • https://cdn.sqhk.co/komiburufezo/nvkcrdb/suriget.pdf
    • https://cdn.sqhk.co/rovifatira/ihiiW9m/73806435528.pdf
    • http://mopasiwamosul.iblogger.org/wevaxodotiporanesoxira.pdf
    • https://cdn.sqhk.co/pategazikiw/czgfjdJ/8557666811.pdf
    • https://cdn.sqhk.co/bizifabov/jCha9jd/textbook_of_biochemistry_for_dental_students.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9fa81b60-9e79-457c-8a3f-ff1105c8307e/nukonubawebitunenewiz.pdf
    • https://uploads.strikinglycdn.com/files/b94799c0-c7ae-47af-b0a4-06b25c7f73d0/sims_3_merge_cc_mac.pdf
    • http://sedoguzod.rf.gd/logitech_k330_keyboard_driver.pdf
    • http://rabopusafat.epizy.com/antonyms_and_synonyms_worksheets_for_4th_grade.pdf
    • https://45b0b119-5f8c-43e7-b437-4e12d17c1c81.filesusr.com/ugd/3826db_4db902e589874ae784cdf133e861ece4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ee3280be-51c7-440d-bb59-179e2128fc17/how_to_use_a_lock_picking_gun.pdf
    • https://uploads.strikinglycdn.com/files/a5f27986-e264-495f-a129-a5d8aa3b2907/lord_of_the_flies_chapters_5-8_quiz_answers.pdf
    • https://d6504552-49b0-4b7d-b1ff-94f9e1082b83.filesusr.com/ugd/1f0558_796d9f223a174fb2b521488a21119255.pdf?index=true
    • http://wurezeradepup.rf.gd/68948738048.pdf
    • https://uploads.strikinglycdn.com/files/ab56914c-48b3-470a-b03e-e33fa6a435f9/41940000595.pdf
    • https://c2093f15-f4fb-4bda-9582-db5404103fa6.filesusr.com/ugd/b28561_5cc4e6c77c5b49a5b3de00c142a8b0f3.pdf?index=true
    • https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_859ba807c2224549b4b94824e4b7c874.pdf?index=true
    • http://xizobofex.epizy.com/20082295449.pdf
    • https://78f121e6-5824-477f-9480-4bf23eba804c.filesusr.com/ugd/9564ad_18fc17f6f01f4a04b60bc34cfcedab60.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f625.bin
7a2729bf31820764a8f6f77899ec76aabe2112c0429e7f85ed62a0b8f5211d91		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF625 5120 bytes
font_01_sfnt_off0001078d.bin
e786a1e73e586ac32c7a0f1d8d0fea0b8394a4571274fb317f743f6c9e65a7a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1078D 11200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.