PDF malware analysis — malicious · 9206a022e6779360

MALICIOUS

PDF

86.7 KB Created: 2021-06-03 13:12:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: 21485ab9e8bd7f8c4e49ab3fba5a7ab9 SHA-1: ef2a64fedb3f7a407f0a8e0eebd0c5ac5b50e156 SHA-256: 9206a022e6779360e8002b4bdcc7c3f0bf4fc251f356cf42861d318bca9c8d0f

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, with a high-confidence heuristic identifying it as a link farm on disposable hosting. One prominent URL, 'https://bologen.ru/123?utm_term=android+app+games+for+couples', suggests a lure related to Android app games. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/123?utm_term=android+app+games+for+couples PDF link annotation
- https://static.s123-cdn-static.com/uploads/4368746/normal_5fc8263443ee5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486045/normal_5fee14b6c2e74.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4368474/normal_60b4db099d081.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4479902/normal_6069d89463183.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373749/normal_603952006fc14.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481673/normal_6044f3bde8921.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502833/normal_5fd3a5c998186.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://dejimebez.pbworks.com/f/internet_explorer_11_download_windows_7_64_bit.pdfIn PDF document text
- http://redelaw.pbworks.com/w/file/fetch/144543735/burudep.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1d26c63b-faac-43df-a10c-03be8a805148/17982500290.pdfIn PDF document text
- http://pinurakus.pbworks.com/w/file/fetch/144548613/the_epistle_of_mathetes_to_diognetus.pdfIn PDF document text
- http://maxasol.pbworks.com/w/file/fetch/144548094/84450014423.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca0eb06a-e50b-4bd6-97b4-d2c28600fa5d/criterios_diagnosticos_para_trombosis_venosa_profunda.pdfIn PDF document text
- http://tezalef.pbworks.com/f/80933152579.pdfIn PDF document text
- http://xedidovetaw.pbworks.com/w/file/fetch/144428016/xibagurarap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4f19d314-7cca-4a65-b6a6-42aa9e653b6f/how_to_light_the_pilot_on_a_trane_furnace.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9a9a4c4d-0888-4630-a5f6-5c45fe78106e/what_is_the_message_of_the_shining.pdfIn PDF document text
- http://vejivab.pbworks.com/w/file/fetch/144461928/dinekuvoduwamuvagurubu.pdfIn PDF document text
- http://bezawagiga.pbworks.com/w/file/fetch/144555447/what_type_of_intermolecular_force_is_methanol.pdfIn PDF document text
- http://bupataved.pbworks.com/w/file/fetch/144427707/zanitulipunusapepux.pdfIn PDF document text
- http://likanegi.pbworks.com/w/file/fetch/144512808/can_you_search_a_person_by_license_plate.pdfIn PDF document text
- http://jujirafamena.pbworks.com/w/file/fetch/144465450/fadagirem.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001072a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1072A	5268 bytes
SHA-256: `d32b19a48a6deeacc423b2122cbbfc6c6daed7da4cf94b29be81c91b9ba2fa04`
`font_01_sfnt_off000118f2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x118F2	10684 bytes
SHA-256: `b6fffd3224090339f2c5ad8457c8a9ca31e9e60aad7ae7d121cd0ba76cc32731`
`font_02_sfnt_off00013d59.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13D59	4324 bytes
SHA-256: `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`

Open this report in the interactive analyzer, or submit your own file for analysis.