Malicious PDF — malware analysis report

Static analysis result for SHA-256 78e6908d40291e74…

MALICIOUS

PDF

89.8 KB Created: 2021-02-08 11:28:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 19d0f265ebcf4447c12668a46c61d72d SHA-1: 1b1b51914dd9f8a2baae8eeaafefff1a00915e24 SHA-256: 78e6908d40291e740f0faeb2c8773725737833cfd0c926e29e0fbb478aa73d7c
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. One of the primary external links points to 'bologen.ru', which is suspicious. The ML classifier and ClamAV also flagged this PDF as malicious, indicating a phishing or malware distribution attempt. Although no scripts were directly extracted, the presence of embedded links and the nature of the heuristics suggest an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=magnetic+field+lab+report+conclusion PDF link annotation
    • https://sukorason.weebly.com/uploads/1/3/4/5/134578332/3039796.pdfIn PDF document text
    • https://viradigoposexa.weebly.com/uploads/1/3/4/3/134383508/ruwevararode.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424328/normal_6006b2153db87.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461505/normal_600dbac7d6fa3.pdfIn PDF document text
    • https://sararilaba.weebly.com/uploads/1/3/1/4/131482808/mazerasidox.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479691/normal_6004e94d78873.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/battery_calibration_code_android.pdfIn PDF document text
    • https://s3.amazonaws.com/genijusemu/dungeon_defenders_2_trophy_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/rozebofukixus/36636682558.pdfIn PDF document text
    • https://s3.amazonaws.com/xidulumexi/66143731518.pdfIn PDF document text
    • https://s3.amazonaws.com/vokeri/debt_snowball_spreadsheet_google_docs.pdfIn PDF document text
    • https://s3.amazonaws.com/fejatepudopito/ayo_and_teo_rolex_music.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/mokemosejewafutefod.pdfIn PDF document text
    • https://s3.amazonaws.com/veledabejufi/lovaju.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/82411573794.pdfIn PDF document text
    • https://s3.amazonaws.com/mipeboro/3d_perspective_business_model_canvas_powerpoint_template.pdfIn PDF document text
    • https://s3.amazonaws.com/firudegix/bluebook_19th_edition_citation_format.pdfIn PDF document text
    • http://geralumumavol.rf.gd/autocad_2014_activation_code.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A72 5468 bytes
SHA-256: 19fd6b2f6019b72047989827ad2e644a954b676e7c4327dae57f30cf26578511
font_01_sfnt_off00011d20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D20 11412 bytes
SHA-256: 5eb38017730ff2a8c4c9155eba7c9610473e19df0fcbf606b07ce2a0039120ae
font_02_sfnt_off0001445c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1445C 16104 bytes
SHA-256: d40343f4045f2acab7b34f94ce4d2321a637a2aef2b070478d781397ba5f70f9

Open this report in the interactive analyzer, or submit your own file for analysis.