Malicious PDF — malware analysis report

Static analysis result for SHA-256 47eaba9c465e6441…

MALICIOUS

PDF

86.0 KB Created: 2021-03-03 22:04:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: bb69592c33bf95d3a4be6370821fbb88 SHA-1: 89754503dc19f5ce283b32e6d034bcb8b381f57a SHA-256: 47eaba9c465e6441c8dbdc12382a0f8d14c3a1b63dd3d96ca47b84f32a75f48a
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded URLs, with a high-confidence heuristic identifying it as a link farm hosted on disposable domains. One of the primary URLs, 'https://bologen.ru/award?keyword=acordes+piano+canciones+famosas', is directly associated with the malicious classification. The presence of PDF-specific heuristics and the ML classifier's output strongly indicate a malicious intent, likely related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7862

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=acordes+piano+canciones+famosas PDF link annotation
    • http://leledup.mypressonline.com/zufetaruvibezogajujitile.pdfIn PDF document text
    • http://wusator.mygamesonline.org/povugavimifadawegugiviz.pdfIn PDF document text
    • https://cdn.sqhk.co/potebuso/gdePghk/finger_guns_gif_download.pdfIn PDF document text
    • http://joxufovogikera.iblogger.org/lap_steel_guitar_string_gauge_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/mipemoku/hDih6hj/piano_keyboard_image_with_notes.pdfIn PDF document text
    • https://cdn.sqhk.co/janezewufaj/deYghWV/planets_visible_tonight_columbus_ohio.pdfIn PDF document text
    • https://cdn.sqhk.co/xalesikozip/jiEibib/drum_kits_for_sale_australia.pdfIn PDF document text
    • http://vipimuxatomefi.medianewsonline.com/why_would_an_immersion_heater_stop_working.pdfIn PDF document text
    • http://zugemenelil.medianewsonline.com/men_without_women_summary.pdfIn PDF document text
    • https://cdn.sqhk.co/vumusokutil/jfH2pUV/1584590170.pdfIn PDF document text
    • https://cdn.sqhk.co/madumubo/jIKghgg/91855850397.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zorikeroz.onlinewebshop.net/8796166699.pdfIn PDF document text
    • http://revobisamapekuz.epizy.com/cessna_caravan_accident_reports.pdfIn PDF document text
    • http://nujivoforegiv.rf.gd/bafujisagew.pdfIn PDF document text
    • http://zetitovafe.rf.gd/37334128254.pdfIn PDF document text
    • http://logiratawune.rf.gd/31036955955.pdfIn PDF document text
    • http://rodedewezijore.atwebpages.com/who_owns_the_christmas_tree_shops.pdfIn PDF document text
    • http://nizowozutagele.atwebpages.com/science_of_mind_core_principles.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010872.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10872 5260 bytes
SHA-256: 8848932356202973ad9344ae701e7d03de42dd4e677e721a4be06dee0fe1786f
font_01_sfnt_off00011a41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A41 11652 bytes
SHA-256: b5dd1ce5cd568584da5f923cd21b9fe3ac28cc2df725a3c5281ff3220ff285fa
font_02_sfnt_off0001404d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1404D 16312 bytes
SHA-256: bf8f9ece8d9d74ce2d7a98a07ee1bb8f4056faf702b3b1702118181e85f1b939

Open this report in the interactive analyzer, or submit your own file for analysis.