Malicious PDF — malware analysis report

Static analysis result for SHA-256 450370dfc5d2b669…

MALICIOUS

PDF

68.7 KB Created: 2021-03-08 00:45:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: e874763df63b63f0dc451219b5dad134 SHA-1: 0b16aea73364517ac8d932d8d02586b7d45e9956 SHA-256: 450370dfc5d2b66937795255ddd7c1a9de9ea2552e963df3cd6b450c9e5f1e95
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains numerous embedded URLs, with one prominent URL pointing to 'bologen.ru', which is flagged as a link farm on disposable hosting. This suggests the document's primary purpose is to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=uno+customizable+wild+card+ideas PDF link annotation
    • http://copyrightproblem.com/what_are_the_responsibilities_of_a_public_relations_officervdevj.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412391/normal_5fee8e9c01194.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389127/normal_6011c79915d79.pdfIn PDF document text
    • http://shortsomfj.space/50267362773dsz77.pdfIn PDF document text
    • http://dfwshootersupply.com/50565414168ovr1x.pdfIn PDF document text
    • http://bighome.space/kozejamafamoxixosijou4x.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6860530-a622-468e-99d2-6935ed3f99ff/are_g_shock_watches_worth_it.pdfIn PDF document text
    • https://s3.amazonaws.com/xazarujokemus/conversion_sheet_math_6th_grade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9224a644-be95-4de4-8f4f-228cdfdbd6b9/6854405028.pdfIn PDF document text
    • https://s3.amazonaws.com/fajeloninesitel/serta_adjustable_bed_base_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb4e5855-ceb3-469b-88cb-6e939c74cada/48942392259.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a66bcd7-89e7-47c4-bf25-195404d71af6/what_is_gods_law.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5f1bec4-2b73-410a-bd5e-65762cdc497b/finanzas_personales.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/621f708d-a9d7-4d40-8fe1-ba37b6f016d8/rf267_samsung_ice_maker_problems.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/729e2fae-f377-4f4f-b0ba-6d4ef802d1d2/attack_on_titan_season_2_ending_song_name.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb5ae3f8-4117-4f75-b716-2afc2767d831/what_is_a_diagnostic_lab_covid_test.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8332c9c8-c069-4c1e-bfce-33daf82f67da/how_to_set_time_casio_edifice_eqs_500.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/241ef966-aaf9-4f82-88c2-2a0c939933ec/78752652671.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e2b5fd3-f204-40ed-a0d8-802c2ec11581/how_to_set_the_time_on_an_armitron_chrono_watch.pdfIn PDF document text
    • https://s3.amazonaws.com/woxewiwupir/nageniviwaditurukotafelut.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0D7 5360 bytes
SHA-256: 44bfc9a04ffa33cd5b6194ccdd63b44c1d068d3288bcf1cdb5ff292f82d51e07
font_01_sfnt_off0000e311.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE311 10064 bytes
SHA-256: 8050c574be60c510e7a64ac4b1340e2d41bc1a55e3802b81118430c1471d9ece

Open this report in the interactive analyzer, or submit your own file for analysis.