Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfb1e2d4bf4181cc…

MALICIOUS

PDF

79.1 KB Created: 2021-03-19 18:39:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ef917124414000465ecd7a8194f8799f SHA-1: 7e3a73d84566b803b7d913cdeff10e1bad6e8f7d SHA-256: bfb1e2d4bf4181cc545a0b2fea07a828bd3f8235623837adbe5050d17513bb9b
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' suggests the document is designed to host a large number of external links, likely for SEO manipulation or to redirect users to malicious sites. The embedded URLs, such as 'https://crophysi.ru/award?keyword=dna+polimerasa+pdf', reinforce this finding by pointing to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=dna+polimerasa+pdf
    • https://futuratolofuzup.weebly.com/uploads/1/3/5/3/135399438/768e509f75c41.pdf
    • https://lenapejasuma.weebly.com/uploads/1/3/4/7/134749539/sokizipukofogeri.pdf
    • https://dupagerenukuxat.weebly.com/uploads/1/3/4/7/134751723/4d971e66a8768.pdf
    • https://pagowabelada.weebly.com/uploads/1/3/0/8/130874520/wutuzopurebejik.pdf
    • https://gonedosi.weebly.com/uploads/1/3/4/7/134730609/1539499.pdf
    • https://bomejafir.weebly.com/uploads/1/3/4/7/134725936/vedunokasite.pdf
    • http://sutiboju.sportsontheweb.net/ielts_recent_actual_test_with_answers_vol_6.pdf
    • https://bajipupetezin.weebly.com/uploads/1/3/5/3/135315063/getiviripe.pdf
    • https://zoninezazazi.weebly.com/uploads/1/3/1/0/131070362/jeridutibu_kuvezozixuk_gimuvoxivorox_bogerosi.pdf
    • https://zegaxazidunuxe.weebly.com/uploads/1/3/4/7/134746987/c1319df71e788fc.pdf
    • https://limorevoxa.weebly.com/uploads/1/3/4/6/134611026/7625083.pdf
    • https://depewezuluro.weebly.com/uploads/1/3/4/1/134108544/d791ef702a.pdf
    • https://zexajupa.weebly.com/uploads/1/3/4/6/134692079/873095.pdf
    • https://kotogafisix.weebly.com/uploads/1/3/0/7/130740127/fomajaberiwuvi_toruvoges_vumozasekep.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a1f76f83-da76-41bf-b74c-ec805b304f27/como_traducir_un_de_ingles_a_espaol_sin_perder_formato.pdf
    • http://tiwatimab.atwebpages.com/irobot_braava_jet_cleaning_solution_alternative.pdf
    • https://uploads.strikinglycdn.com/files/ad308c20-7829-4494-9ef6-a214f9544dda/bowflex_pr1000_workout_routine.pdf
    • https://uploads.strikinglycdn.com/files/e1f9ee40-a71a-4063-b0c8-7d891eb299af/the_river_church_tampa_bay_florida.pdf
    • http://geforagegi.atwebpages.com/lenovo_g50-80_i3_price_philippines.pdf
    • http://roveramo.atwebpages.com/46017570873.pdf
    • https://s3.amazonaws.com/tanapilamaxi/why_does_a_song_bring_back_memories.pdf
    • https://s3.amazonaws.com/fizufapu/28692359569.pdf
    • https://s3.amazonaws.com/taguxif/can_you_do_emdr_online.pdf
    • https://s3.amazonaws.com/lakujusitejojet/how_much_do_raynor_garage_doors_cost.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7e0.bin
05250592c72c4404d18144aaecde3e197f2b88a249241a90955105f4f3bc23d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E0 5188 bytes
font_01_sfnt_off00010972.bin
850a013746fbcae3758ae0ac50b892e032a8f0b8bddbd050bf6d3b13c17136f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10972 11136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.