Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5fe5ecaa88abfc7…

MALICIOUS

PDF

69.6 KB Created: 2021-03-14 22:03:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 207ed38ba0a9f662450849cd55b78389 SHA-1: 2cabc55d62eafaf3d9c77f4907b0740cb262d803 SHA-256: e5fe5ecaa88abfc7d75096d2d6afd1bb479c990450ad6ce08badc79c1574ad9a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which are part of a link farm designed to manipulate search engine results. The primary URL, https://pelibifir.ru/strik?utm_term=monster+energy+vs+red+bull+sales, suggests a lure related to energy drink sales, likely a phishing or scam pretext. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8294

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=monster+energy+vs+red+bull+sales
    • https://cdn.sqhk.co/fulaxanew/jeGzhef/let_s_survive_survival_in_zombie_apocalypse_wiki.pdf
    • http://astropsychology.website/deravevezimuwazamoxpo6wn.pdf
    • https://xanalefude.weebly.com/uploads/1/3/1/4/131411596/4144799.pdf
    • http://komaxinatobofe.medianewsonline.com/58358199387.pdf
    • https://cdn.sqhk.co/mujawiru/JvjfEgi/33085310551.pdf
    • http://albatros-trans.ru/talking_tom_jetski_2_game_downloadl684h.pdf
    • http://jawixogu.mygamesonline.org/what_does_monster_symbolize_in_a_dream.pdf
    • http://djami.ru/dowadanaloneiundf.pdf
    • http://pilizepanaritob.22web.org/23048866187.pdf
    • https://cdn.sqhk.co/gukawaki/Muheifv/74569979786.pdf
    • https://cdn.sqhk.co/lanumakefu/ijRkhii/gokapesusabomu.pdf
    • https://dipakexamima.weebly.com/uploads/1/3/1/0/131069759/2854122.pdf
    • https://cdn.sqhk.co/lojumisebu/jejaXjd/tile_matching_game_online_free.pdf
    • https://fosevikotik.weebly.com/uploads/1/3/1/6/131637163/2162920.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c788b29d-df2d-4d46-9946-349e8cce89b7.filesusr.com/ugd/a9e086_e0171ff17a3443e99d679682be778c25.pdf?index=true
    • http://xojazexodiwosi.epizy.com/59475046779.pdf
    • https://17c3d818-7f64-4152-976a-2fa997d7a7be.filesusr.com/ugd/e2c250_3c6e7e5c68a3430c89aa1abb88fd7db8.pdf?index=true
    • https://9de673a2-3b8e-40eb-bbf5-c0ad8e71a3da.filesusr.com/ugd/bd5c68_8014789b1ccc4938b9c66206e5a12c6a.pdf?index=true
    • http://wifobujaxude.epizy.com/cutting_tools_catalogue.pdf
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_4b8599a7a154487b80e03323d09b8d19.pdf?index=true
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0d9.bin
824b08f2577709bda81dde6afaf7818d10bac0275f1ef09dac41d14b7f861d99		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0D9 5300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.