Malicious PDF — malware analysis report

Static analysis result for SHA-256 eeae07aafe2a6359…

MALICIOUS

PDF

75.8 KB Created: 2021-04-17 15:47:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0183b53491d614edb5527793fef9ce8 SHA-1: d3d0f8f517e2d1bfefd46633375bf31be4ce7940 SHA-256: eeae07aafe2a6359f4d233151b64cdd58a76f803bc73a03730f80a5e059d1e77
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which point to PDF files, suggesting a link farm or redirection mechanism. The primary external URI, 'https://gimoguvi.ru/strik?utm_term=five+nights+at+freddy%2527s+the+silver+eyes+audiobook', is likely used to direct users to malicious content, possibly related to phishing or malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=five+nights+at+freddy%2527s+the+silver+eyes+audiobook
    • https://cdn.sqhk.co/segevenujuka/Nhje5cH/fopewelovofijuxenegaxe.pdf
    • http://zugapuvu.mywebcommunity.org/wumul.pdf
    • https://cdn.sqhk.co/pulobegefuzi/jg2UrC1/kexedunokofe.pdf
    • https://cdn.sqhk.co/ragejeli/jijfcLc/hashtags_for_instagram_memes.pdf
    • https://cdn.sqhk.co/wowasuperan/VQoK4hd/akashaganga_movie_songs_free.pdf
    • https://cdn.sqhk.co/fofotixoz/hfifghm/kidavema.pdf
    • https://cdn.sqhk.co/wedowetaso/ggcCiia/advertising_key_success_factors_in_business.pdf
    • https://cdn.sqhk.co/majumoros/dO0ifhi/xutisubigukap.pdf
    • https://cdn.sqhk.co/kerosumumato/D5Nhihi/don_t_starve_shipwrecked_dry_season_guide.pdf
    • http://pakaxofuj.sportsontheweb.net/management_is_doing_things_right.pdf
    • https://cdn.sqhk.co/jirudumom/q7YZbih/kosasagen.pdf
    • https://cdn.sqhk.co/datisafapuv/dhjdjdR/outliers_book_review_summary.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ff999131-262c-4f46-aa1e-84c50d3d9e43.filesusr.com/ugd/a474dd_329fd6c1835849d984036cc18d4aed98.pdf?index=true
    • https://uploads.strikinglycdn.com/files/14524c22-8a83-478f-b428-0c40a168f7aa/84604212038.pdf
    • https://6d5fec37-5936-4ae8-8938-03a86e982f09.filesusr.com/ugd/d4da64_1e99ac68892e4a8aba423f35397852fd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d71222bf-f627-4b15-bcd0-eb6d2c01ec48/what_is_the_principles_of_prehistoric_art.pdf
    • https://d09251a9-b09e-4077-8ccb-24037f005f7b.filesusr.com/ugd/a6ce17_cca0f127ab4740b69361593b1f85f72f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e9d68e0d-91b5-4bf1-a2c1-d7811c85485f/how_do_you_start_a_new_paragraph_in_an_excel_cell.pdf
    • http://luvetux.myartsonline.com/14827438038.pdf
    • https://uploads.strikinglycdn.com/files/6bd889d1-5b01-43b5-8144-4f20580558af/94890724510.pdf
    • https://uploads.strikinglycdn.com/files/bc8477c1-079f-40bc-9b82-ed05748991b4/direct_proof_math_examples.pdf
    • https://eeff404e-5492-4914-a1d7-e39d1f35e6b2.filesusr.com/ugd/e58d70_2a1ab713a7624192b50a7a7d94ac08c6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e855.bin
3f05951429a38c460ea81c8170e6bb071116b708a4a3c39f1cc030a5e70f5ab0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE855 5524 bytes
font_01_sfnt_off0000fb37.bin
c2ce5fef7f4c83e1620dbd41dec314a7432f7c1bf7019dd7d6e7d066ee167d28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB37 11056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.