Malicious PDF — malware analysis report

Static analysis result for SHA-256 eee8eba3e6c55988…

MALICIOUS

PDF

70.0 KB Created: 2021-04-28 05:56:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: db4fcb123cea4f048190107f4bc2d1f1 SHA-1: 9f48cc8e4d8446c6dd17b4c994b3941b67b2f784 SHA-256: eee8eba3e6c5598843a540cdd5ed04392284223d16cb22f75841fddf203b4827
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, suggesting it is part of a link farm or phishing campaign. The primary malicious URL identified is https://pelibifir.ru/strik, which is likely used to redirect the user to a malicious site or download further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=ge+healthcare+human+resources+phone+number PDF link annotation
    • http://ribavid.medianewsonline.com/17704530448.pdfIn PDF document text
    • http://tebeririz.scienceontheweb.net/guzekarefubojekefegez.pdfIn PDF document text
    • http://mebovedu.getenjoyment.net/sample_application_letter_for_bank_job_fresh_graduate.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://7a1f2a0d-094a-4466-88af-72a4af93b9fa.filesusr.com/ugd/22739b_354b58371bde4404adcc15ac298cf337.pdf?index=trueIn PDF document text
    • https://e966359d-176b-477a-9ad9-c314bea94227.filesusr.com/ugd/fa6f14_d2764493073947c69b5abcb22b4a61b1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/timeziso/what_do_you_need_for_a_ms_drivers_license.pdfIn PDF document text
    • https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_13eda23fe130413586844e0eca1a9ae2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wixatax/27620389445.pdfIn PDF document text
    • https://c4647614-9ff8-4b00-b819-08dc938bd166.filesusr.com/ugd/5d3f24_c434398871934998add76acb910eabfc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/libowebujakux/kajinakonunavode.pdfIn PDF document text
    • https://s3.amazonaws.com/donukadizolin/how_to_set_time_casio_5081.pdfIn PDF document text
    • https://s3.amazonaws.com/wulotugadag/wings_of_fire_kannada_book.pdfIn PDF document text
    • https://s3.amazonaws.com/fazujo/pafiro.pdfIn PDF document text
    • https://s3.amazonaws.com/muvarelo/jebiwugakakimu.pdfIn PDF document text
    • https://s3.amazonaws.com/migivewuwe/komixekakizeruza.pdfIn PDF document text
    • https://s3.amazonaws.com/daselex/ariel_rivera_album.pdfIn PDF document text
    • https://6cdb29d4-22ce-4aaf-9e51-562b59d50851.filesusr.com/ugd/1b20fb_1b4a57876ca44556ae82ce9894686a90.pdf?index=trueIn PDF document text
    • https://98cdd5c5-c43e-49eb-9373-39517e896cbb.filesusr.com/ugd/90661f_fbf71e047a2d4e04a7cade8d3f132648.pdf?index=trueIn PDF document text
    • https://200c4c3d-185b-4246-b99f-f40cd7065c99.filesusr.com/ugd/3ed902_7060dc2f41754e729fefc24eac9540e3.pdf?index=trueIn PDF document text
    • https://1b53f64c-3596-40ff-86ea-95cec8902569.filesusr.com/ugd/838e7e_ad7301b214ad40208fe961a203c2baaa.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sitok/vonulefimisefuz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4DE 5344 bytes
SHA-256: 64d9b1bd1f0f94fdc82698f0c6c713e6cbf537404d647a0a9c53a8392644f582
font_01_sfnt_off0000e6db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6DB 10284 bytes
SHA-256: e90223da917e10ecb6286b90bc096b14b359af7846ad2c827cd469024c4e42c6

Open this report in the interactive analyzer, or submit your own file for analysis.