Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0ca8afda16b42aa…

MALICIOUS

PDF

87.9 KB Created: 2021-03-24 19:56:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 737367f9f2be2b40a70c4673a8ebca03 SHA-1: d5dbc9a96e44bd17748463306f4a9d1e2f22e9a8 SHA-256: a0ca8afda16b42aa620818ceb8e77a28052ef1eba8c21a3138317849a6fbca57
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to benign-looking documents, suggesting a link farm or SEO poisoning tactic. One of the embedded URIs, 'https://bologen.ru/123?utm_term=gymshark+shorts+size+guide', is suspicious and likely leads to a malicious site. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/123?utm_term=gymshark+shorts+size+guide PDF link annotation
    • https://cdn.sqhk.co/kezixowog/ijsMnzX/free_robux_hack_no_verify.pdfIn PDF document text
    • https://cdn.sqhk.co/puvubuzu/jciilEu/wepogukutipope.pdfIn PDF document text
    • https://cdn.sqhk.co/kakapoxavu/iaClBic/master_car_climb_racing_3d_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/xeposetuge/ihjHgf1/zelamijugomulajojo.pdfIn PDF document text
    • https://cdn.sqhk.co/zivudasexoni/iiTsZIj/xarajiz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/sedowedi/what_is_corporate_identity_and_branding.pdfIn PDF document text
    • https://s3.amazonaws.com/gawabog/australian_christmas_images_free.pdfIn PDF document text
    • https://s3.amazonaws.com/tezude/lorazitozafif.pdfIn PDF document text
    • https://s3.amazonaws.com/serogajugomiji/run_less_run_faster_training_plan_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/ragejufa/acronis_backup_12._5_free.pdfIn PDF document text
    • https://s3.amazonaws.com/zabejuvijolu/treble_and_bass_clef_worksheets.pdfIn PDF document text
    • https://528a8416-53f4-4693-bcf0-540471887af1.filesusr.com/ugd/c3aa89_4c0275b39e5743429a120f7023498d80.pdf?index=trueIn PDF document text
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_dc0f8290b6874932a9e7741df7ac734b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vigevot/how_much_does_gum_grafting_cost_with_insurance.pdfIn PDF document text
    • https://s3.amazonaws.com/sefepugolupalax/there_is_there_are_questions_and_short_answers_exercises.pdfIn PDF document text
    • https://s3.amazonaws.com/dudurat/samsung_58_q60t_review.pdfIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/sanironipubipilizizikaj.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/attendance_list_form.pdfIn PDF document text
    • https://s3.amazonaws.com/kabisebax/total_gym_1100_owners_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f480.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF480 5232 bytes
SHA-256: ce17d659c879d3e3cf8695f83fce4a3792bf1f3951d77046f164ca275cb4403c
font_01_sfnt_off00010662.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10662 12272 bytes
SHA-256: 10f4df86613299c855ce6c7483dd26753b2ea99b3293b8e12abf9a5f6fe184ca
font_02_sfnt_off00012f73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F73 16060 bytes
SHA-256: c46c0605e6de68f526770b35f02e9451d7ae7c0e0d79b6a66872b6650ded16ce
font_03_sfnt_off0001440d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1440D 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.