Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf3049415085e5ef…

MALICIOUS

PDF

77.8 KB Created: 2021-03-11 14:48:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d3994e6ec99a64cf607d31e276d533fb SHA-1: 4b8264f303a0812c3f2689d6c0da0ca36295828a SHA-256: cf3049415085e5ef5fa80416b26f6cb1b7e06cc0ea4e0e2ac9efc058348ab04f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a 'PDF_SEO_LINK_FARM'. The primary URL, 'https://bologen.ru/award?keyword=all+function+in+excel+pdf', suggests a deceptive lure to attract users searching for Excel-related information. The presence of many external links, including 'http://visisobaropa.epizy.com/nupenupenotoletedabuvijan.pdf', indicates a high likelihood of distributing further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=all+function+in+excel+pdf
    • http://xepusuxewo.iblogger.org/85663152647.pdf
    • http://muvirire.22web.org/how_to_clean_roomba_880_side_wheels.pdf
    • https://cdn.sqhk.co/terasovo/bBKYggt/average_age_clash_royale.pdf
    • https://cdn.sqhk.co/lokutibu/7XdRuKB/27708202997.pdf
    • http://akfb.online/bersa_thunder_380_ankle_holster_reviewxyr5z.pdf
    • http://eslivdrug.space/velimowapezisakonuf4z68l.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://visisobaropa.epizy.com/nupenotoletedabuvijan.pdf
    • https://488c2ff9-9ff4-499e-8f11-525115e20b22.filesusr.com/ugd/8aba0c_ec732605796a48bb99755828db5d8228.pdf?index=true
    • https://s3.amazonaws.com/zerepuzuze/98903176340.pdf
    • https://s3.amazonaws.com/donukadizolin/what_is_a_sad_poem.pdf
    • https://s3.amazonaws.com/penefelomiju/90578802983.pdf
    • https://s3.amazonaws.com/baxunaf/vedic_sidereal_astrology_dates.pdf
    • http://xumugipetoje.epizy.com/logitech_mx_anywhere_2s_manual.pdf
    • https://s3.amazonaws.com/woxorojero/bojisujapolejububenapa.pdf
    • http://gejaxogepokotow.rf.gd/vowamijexitagogufemi.pdf
    • https://s3.amazonaws.com/fejakixoweka/adobe_photoshop_cs6_for_ubuntu_18._04.pdf
    • https://5f8b0e40-2141-4341-98ab-6145db4b8156.filesusr.com/ugd/2072cd_464f2850ede74d34978de14c7dce7dfc.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e978.bin
d2b139eddb2d1f2058eb777930f9740a590d8560233978dbb49b8cc71254387c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE978 4604 bytes
font_01_sfnt_off0000f933.bin
09dfa75b45f527085a52740e7d468ff243c86d5600d1d80ff5cd7744bdf3f6e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF933 10212 bytes
font_02_sfnt_off00011bfa.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BFA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.