Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba13aaf26613fc73…

MALICIOUS

PDF

77.9 KB Created: 2021-03-14 22:22:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6ed5116f751f60b4e9a9c971a72488ca SHA-1: d881de8276f66ae14bc774bfed003bee490b7c70 SHA-256: ba13aaf26613fc7342aeaae459552dd4e224ea35b43eb3b6c773ba285a3d5f2d
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which appear to be part of a link farm designed to manipulate search engine results. The primary URL, 'https://bologen.ru/wix?keyword=the+coincidence+of+callie+and+kayden+pdf+espa%25C3%25B1ol', suggests a lure related to a specific PDF title, likely to trick users into visiting a malicious site for phishing or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=the+coincidence+of+callie+and+kayden+pdf+espa%25C3%25B1ol
    • https://kopigipovivon.weebly.com/uploads/1/3/1/4/131484029/9620875.pdf
    • https://static.s123-cdn-static.com/uploads/4382974/normal_6005ff3ad31df.pdf
    • https://funopazotasar.weebly.com/uploads/1/3/1/0/131070342/1946536.pdf
    • https://cdn-cms.f-static.net/uploads/4468836/normal_5fd277da7743e.pdf
    • https://cdn-cms.f-static.net/uploads/4375340/normal_601590f973da3.pdf
    • http://fojimow.iblogger.org/janigozariwem.pdf
    • https://static.s123-cdn-static.com/uploads/4382772/normal_5fe02a2e6df12.pdf
    • https://ranetaxute.weebly.com/uploads/1/3/4/8/134886021/falugorurax.pdf
    • https://cdn-cms.f-static.net/uploads/4382406/normal_5fe7329dcb286.pdf
    • https://sawolopu.weebly.com/uploads/1/3/6/0/136049845/79d45b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c0b8f06b-4e98-4d3d-89ef-2f08caba629a.filesusr.com/ugd/0c8cc8_a1f307cb99a047e9a7ac86a4034de3ec.pdf?index=true
    • http://jabelakejirer.epizy.com/87179915141.pdf
    • https://s3.amazonaws.com/zarevizebi/comptia_pentest_plus_study_guide.pdf
    • https://s3.amazonaws.com/kujesulad/luces_de_bohemia_pelicula_resumen.pdf
    • https://s3.amazonaws.com/rewepalazamiso/what_is_the_main_theme_of_orpheus_and_eurydice.pdf
    • https://s3.amazonaws.com/jivuxo/a_formal_definition_of_culture.pdf
    • https://71a5d838-4e22-4830-8da1-7955ec3365f5.filesusr.com/ugd/f2f43e_345217f960cf4360acca4d47b09aa3f1.pdf?index=true
    • https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_0d70a9e6cd464dfeb73d886c6131eafc.pdf?index=true
    • https://s3.amazonaws.com/rafiralexezol/free_video_screensaver.pdf
    • https://bed2d873-735b-46bb-a8a3-264d0455df4e.filesusr.com/ugd/03ede2_ab4df2dae2c94664b9f63ec8c25e2bff.pdf?index=true
    • http://susugafof.epizy.com/lusasup.pdf
    • https://e6676b24-921d-4f57-8fca-beda98688f3c.filesusr.com/ugd/144d27_6095d8377d5f44058663614ea1f4e745.pdf?index=true
    • https://s3.amazonaws.com/posufij/ars_poetica_by_archibald_macleish.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec56.bin
56ca1de142aa344dde15dbbec0fdea43a7e7631530e7782d442498471d3d9f93		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC56 5472 bytes
font_01_sfnt_off0000febd.bin
ff6e5ce91c115c24c3091e98ceeae5fcc56e024cb97fe1280fd951f442c898a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEBD 12828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.