Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0a8352ac26f6ed0…

MALICIOUS

PDF

78.6 KB Created: 2021-03-16 21:02:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 05418cf37473be37b3d59a6f2e8c5bf3 SHA-1: 265d70643aa2ecb6227e2c7d963d887660737991 SHA-256: b0a8352ac26f6ed092ed0061646ceaf720b7f0c3ec69f001f3ede1375be0263e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged by multiple heuristics as malicious, including a critical finding for a large number of external links, suggesting a link farm or SEO poisoning attempt. The ML classifier also returned a high score. While no executable scripts were extracted, the presence of numerous external URLs, one of which is categorized as unknown and another as benign but part of a large list, indicates a strong likelihood of directing users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=ge+betz+canada
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/badodemebo/runakojan.pdf
    • https://s3.amazonaws.com/pubopelej/nursery_worksheets_english.pdf
    • https://s3.amazonaws.com/kelukakeb/kasiwugologizinidepimawi.pdf
    • https://uploads.strikinglycdn.com/files/e8d2cac0-4256-4676-ba08-bc43987e146d/2015_ford_f350_parts_manual.pdf
    • https://uploads.strikinglycdn.com/files/5767dcc8-2f8b-4930-8f63-c7d6a8b6c07c/richland_borough_zoning_map.pdf
    • https://uploads.strikinglycdn.com/files/3023a42e-0ba5-44f6-968c-288dca2a5703/decision_tree_analysis_excel.pdf
    • https://s3.amazonaws.com/nisiwanolom/college_website_templates_free.pdf
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_a271f8d3b79e4e51a70a07b9903b6553.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2b94bdff-c853-4c7b-9ac3-795c188c0896/39328302067.pdf
    • https://uploads.strikinglycdn.com/files/3bf4503d-1d0e-4d6f-8428-1d6eebe385c4/43168426456.pdf
    • https://uploads.strikinglycdn.com/files/4ddc1e95-fbf6-4c40-9215-17966a4515dc/wuzarowobil.pdf
    • https://uploads.strikinglycdn.com/files/5b201f64-b3fa-497b-adf2-88ba879ad94c/38201073757.pdf
    • https://uploads.strikinglycdn.com/files/4833930a-2dc1-4505-8bf3-d012c4f7d895/mgma_podiatry_salary.pdf
    • https://s3.amazonaws.com/rokuwapesu/sejaludikukipiwim.pdf
    • https://uploads.strikinglycdn.com/files/9466592e-bf6e-444b-bfb4-4da6aa9731ff/eventide_timefactor_looper_midi_sync.pdf
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_f8b292b4a92f45eebbb7be2c1e9be18a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e31458d3-3658-4d3b-8ce8-b2357c47fa0d/the_rules_of_attraction_film_review.pdf
    • https://s3.amazonaws.com/jufowokedunod/21398462614.pdf
    • https://s3.amazonaws.com/xeroguru/elementary_korean_download.pdf
    • https://uploads.strikinglycdn.com/files/f692b45f-874c-4b97-bbcc-d264ed81355c/zubaxazizemax.pdf
    • https://uploads.strikinglycdn.com/files/2dd0f336-fb28-48f3-a917-9fac64b47cf0/39932711415.pdf
    • https://uploads.strikinglycdn.com/files/b16506cb-feff-4118-b212-1786f1a33f56/what_are_the_ethical_principles_of_christianity.pdf
    • https://d75bbb92-b0e4-4b50-83e6-2443e695523b.filesusr.com/ugd/bc73b9_3cbcc352868a4ebb813401a167bc960a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/852ab327-2691-4f54-9236-79e70fc8ca2c/hamlet_book_review.pdf
    • https://37bcb4aa-7747-4ff6-a352-0e22bf983c21.filesusr.com/ugd/4393d3_14337bece03f486089f6ea3d56edea5e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4c6.bin
eb9b4c554460667d35e9de9630029da2d0a799d486445373d4ea72eae24d9273		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C6 4848 bytes
font_01_sfnt_off00010561.bin
9d35fd5276f54a10029e993c514fa78b5575a1c89b1698176ad2710bf603b34a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10561 11080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.