PDF malware analysis — malicious · 6fa8bf2edc0d3ae2

MALICIOUS

PDF

64.4 KB Created: 2021-03-20 22:16:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16

MD5: 0f77c57a02be862d132e9e1b953c4b44 SHA-1: d4dfa32cdf95d88dd904563944e695c26493d2c3 SHA-256: 6fa8bf2edc0d3ae2415c04f46572ca2ff545198b1a756d8d5101d308d2121d80

186 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a link farm pointing to numerous external PDF documents, likely intended to redirect users to malicious content or phishing sites. The primary external URL observed is https://bologen.ru/aws?utm_term=microlife+blood+pressure+machine+error+3, which is presented in the document body as information about a blood pressure machine error.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/aws?utm_term=microlife+blood+pressure+machine+error+3 PDF link annotation
- https://cdn.sqhk.co/tawavumazo/bgfgjib/u_mobile_centre_kuantan_parade.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393363/normal_60330ec41fe38.pdfIn PDF document text
- https://cdn.sqhk.co/sujutowupolu/ijfhH7w/arm_wrestling_2_player_games.pdfIn PDF document text
- https://cdn.sqhk.co/josipinu/el0bbhd/5950074697.pdfIn PDF document text
- https://cdn.sqhk.co/juxerawabuf/giOheAB/luxuxonapexonopinuzufakuj.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4391634/normal_5fdc522dc72fd.pdfIn PDF document text
- https://cdn.sqhk.co/sepetuvab/ZlAjSbD/mobile_legends_bang_bang_tier_list_august_2019.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://6196a4e6-b3b5-4a85-a139-4ec84e0a53d9.filesusr.com/ugd/d01287_a5f0fbed41ae483fa201183b42b70861.pdf?index=trueIn PDF document text
- https://183df7f2-4185-4ca0-bfcc-33b39bc842f1.filesusr.com/ugd/9ac34a_02d215d1ab7f41a080c24fe44be3881a.pdf?index=trueIn PDF document text
- https://6c8027e1-9878-41b3-a9ef-32ba2b6bcd02.filesusr.com/ugd/185811_7bf411ce33394e56b45571c16f00b256.pdf?index=trueIn PDF document text
- https://a909b8fe-7c6e-4467-a5b6-92e64a2a5b5d.filesusr.com/ugd/65efca_91e9d137caf64978abc8d19efad5c0f8.pdf?index=trueIn PDF document text
- https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_e9a4b6e4332b48a18ff5d7600867ed40.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lerezazo/how_to_install_wood_garage_door_bottom_seal.pdfIn PDF document text
- https://0efdb04f-128a-4c0d-ace4-8b312723ebcc.filesusr.com/ugd/5508f4_c7f15d4671404dbbbbc01d584fc4d8ae.pdf?index=trueIn PDF document text
- https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_65377d1476ed4eb8af7cb83645664d76.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/widetunipet/27652727765.pdfIn PDF document text
- https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_ec46e6d54a5f49b18fcaebf47185d35d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sebunuzu/83427549649.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c09b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC09B	5704 bytes
SHA-256: `f5b248ceb81d7b7e5618ce1eef67221b2af3d39147a7232aa861dca5cda45dde`
`font_01_sfnt_off0000d3dc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD3DC	9568 bytes
SHA-256: `9e68c97de89e954442c6e7a6e6a7397f788bc3c58f74ca6fdcbac2d72c1ff59e`

Open this report in the interactive analyzer, or submit your own file for analysis.