Malicious PDF — malware analysis report

Static analysis result for SHA-256 18323682e28c1fa2…

MALICIOUS

PDF

79.7 KB Created: 2021-02-25 16:07:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: d37497a09690285a55473d3565b8a6b5 SHA-1: f44b2d4843c70e57252bf15c15a2756ae5030d7f SHA-256: 18323682e28c1fa244912133292d835c69826094b7c1a40284a2be19ebe929e6
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a link farm designed to host malicious content, and it is flagged by ML classifiers and ClamAV as malicious. The document body, though partially garbled, suggests a lure related to printer IP addresses, directing users to a URL hosted on 'bologen.ru'. This URL is likely part of a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=where+to+find+the+ip+address+on+a+canon+pixma+printer PDF link annotation
    • https://cdn.sqhk.co/zedawuzijis/jidhaib/sulowatuk.pdfIn PDF document text
    • http://jasazotinalol.mygamesonline.org/viponikuf.pdfIn PDF document text
    • http://niwapona.iblogger.org/51920909595.pdfIn PDF document text
    • http://jabilevij.mypressonline.com/gazutowunonoba.pdfIn PDF document text
    • https://divetuguwopad.weebly.com/uploads/1/3/0/7/130739619/6695034.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491152/normal_6005f3dbb3b9c.pdfIn PDF document text
    • https://bokowamimufap.weebly.com/uploads/1/3/2/7/132712050/levarewusesalavu.pdfIn PDF document text
    • https://fixaporaxaju.weebly.com/uploads/1/3/1/4/131413905/letuwuma.pdfIn PDF document text
    • http://mufutekuson.getenjoyment.net/muwasubaw.pdfIn PDF document text
    • https://dafebifu.weebly.com/uploads/1/3/4/3/134399244/471fa.pdfIn PDF document text
    • http://raguvigawak.mypressonline.com/10471316998.pdfIn PDF document text
    • https://cdn.sqhk.co/sivunukiwe/fvM2gdN/10632351528.pdfIn PDF document text
    • https://cdn.sqhk.co/firimubujosu/xieghzZ/heir_of_light_guide.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/luropiw/fumexaxodivodaw.pdfIn PDF document text
    • http://jerajunegadadu.rf.gd/where_is_the_turbo_on_a_2013_ford_escape.pdfIn PDF document text
    • http://tawimefozogav.epizy.com/what_does_sat_subject_tests_not_offered_on_this_date_mean.pdfIn PDF document text
    • http://mubidixosi.epizy.com/feasibility_report_on_fish_farming.pdfIn PDF document text
    • https://s3.amazonaws.com/tapelu/sadeduvoguletetemufub.pdfIn PDF document text
    • https://s3.amazonaws.com/xirixepo/colorectal_cancer_screening_guidelines_2018_medicare.pdfIn PDF document text
    • https://s3.amazonaws.com/juduk/45013332257.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa94.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA94 5444 bytes
SHA-256: 104f90fe0df78c8acedf00dd8b7530796b663592132a9fe2f84843bbe1a12528
font_01_sfnt_off00010d07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D07 10512 bytes
SHA-256: dcd2162af4b6524ced9e8168e13ad87b31c0a14680af0f913d24416473b35b96

Open this report in the interactive analyzer, or submit your own file for analysis.