Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ae05e93d76d0ddd…

MALICIOUS

PDF

76.9 KB Created: 2021-03-18 21:41:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 57bd73a22360cd59f6306c28560400f2 SHA-1: f7aa7a05017125bdc1ffe441d7e2568056d7fbc7 SHA-256: 3ae05e93d76d0dddedb162e067fa990635de931d91df719ed105c3ebfe8c4089
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing or trojan. It contains a large number of external links, forming a link farm, with the primary observed URL being https://bologen.ru/wix?keyword=physics+distance+and+displacement+worksheet+answer+key. The document body is heavily obfuscated and appears to be generated content, likely intended to mask the malicious intent of redirecting users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=physics+distance+and+displacement+worksheet+answer+key
    • https://cdn-cms.f-static.net/uploads/4387224/normal_5fd8d3ef65e52.pdf
    • https://cdn-cms.f-static.net/uploads/4458404/normal_6031617a15050.pdf
    • https://static.s123-cdn-static.com/uploads/4444622/normal_5ffc52826cb36.pdf
    • https://static.s123-cdn-static.com/uploads/4374518/normal_5fe3dd0dbec23.pdf
    • https://cdn-cms.f-static.net/uploads/4421342/normal_603d985ad8582.pdf
    • https://cdn-cms.f-static.net/uploads/4426942/normal_601fe0b02fd78.pdf
    • http://kovatafob.mypressonline.com/xukesubegatexemabikamara.pdf
    • https://cdn-cms.f-static.net/uploads/4415748/normal_600dff74dd9a0.pdf
    • http://govuxojikasumot.scienceontheweb.net/mixture_and_alligation_problems_download.pdf
    • https://cdn-cms.f-static.net/uploads/4384142/normal_60244f0ab41a3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b5c90759-dbf8-4ccd-b12d-e23c958527f9.filesusr.com/ugd/915a55_ac224efb96c9468495a137a7ceff005f.pdf?index=true
    • https://30383b9b-b26a-44f4-9a26-03873af8f03c.filesusr.com/ugd/fdee49_e98d08ec3d3f4fc78413809eb06de436.pdf?index=true
    • https://07a970a6-a864-461d-ba0c-8deda34efc75.filesusr.com/ugd/b56c0d_3c10ef591cfb49f09414ea9f861302cb.pdf?index=true
    • http://loxupobupibim.atwebpages.com/ethical_issues_in_secondary_research.pdf
    • https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_30df6ff342324d4cb9df572ff5c98879.pdf?index=true
    • https://104e0e48-a4c2-4a03-8647-06ef64d4e6ac.filesusr.com/ugd/e2c6c1_6be5f5b512e642698116f6a16f0d04dd.pdf?index=true
    • https://ba428ff1-d53d-4eb5-bdb2-cc960067f420.filesusr.com/ugd/7041e4_647c8fbe70b1486f84482ea429519a97.pdf?index=true
    • https://5fb42ee6-a9be-400a-98f2-f9d4b9f720c8.filesusr.com/ugd/1813b3_b868a91b54704fffa46723fefff83143.pdf?index=true
    • https://d2faa26e-66ca-44cd-8f84-883624a71019.filesusr.com/ugd/dbbfd0_0cdd59486a7c466b83b80bf4ca3e6b48.pdf?index=true
    • https://d670dda7-df53-4ef1-8eda-d3256df28744.filesusr.com/ugd/dbbbec_79dfd5916a3d4364b264d57472a08299.pdf?index=true
    • https://c931c956-7f53-4e4e-96dc-27d7f003ba63.filesusr.com/ugd/b80c10_d48ba4dbf4d04aa583ddaa2a19390cc1.pdf?index=true
    • https://4465b75e-e642-4f53-8c89-e22f0b9d4994.filesusr.com/ugd/ecd213_4931f4192ec0470fb813c6ca2b253e45.pdf?index=true
    • https://e0eedba4-cf99-4c42-97f5-d3f9ae5832dd.filesusr.com/ugd/e36ea7_082c85ee99cf41cbae5c9d7a619acea2.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f054.bin
ce4594664038891b86e94cc6e40d0041c28192310f1dec43964cc081aa00066a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF054 5572 bytes
font_01_sfnt_off00010335.bin
8457f36d2b88ae349c9e4dcb594e54b1d355910dce12b36153f3ab7762fb8ee5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10335 10036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.