Malicious PDF — malware analysis report

Static analysis result for SHA-256 d353f91a0e34c9b2…

MALICIOUS

PDF

85.6 KB Created: 2021-03-25 10:31:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fcf36c19f93d11d8f21d5a87deaaf2c8 SHA-1: e8ae1f68a3637b83ed3df474091e5faa7d3ea5bd SHA-256: d353f91a0e34c9b21b4aca83b2634d3062fcd2381e838dd4b564c9cada3f3bf7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are likely part of a link farm or SEO manipulation scheme, with one prominent link pointing to 'bologen.ru'. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the overall structure suggests an attempt to redirect users to potentially malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=biodynamic+farming+pdf
    • https://cdn.sqhk.co/dikozogub/i8gggja/toilet_paper_clicker_infinite_idle_games_2018.pdf
    • http://dwatches.site/pentax_k-70_dslr_camera_with_18-55_lens_-_blacktd92f.pdf
    • http://abistrans.ru/how_to_do_a_border_on_a_crochet_baby_blanketv3zvd.pdf
    • https://cdn.sqhk.co/suxujaba/jjfWkAw/76307819855.pdf
    • https://cdn.sqhk.co/letarezetap/2fjdugc/candomble_religion.pdf
    • http://criticcxck.space/robugumow5ogue.pdf
    • https://cdn.sqhk.co/kamufegoke/gjvOjc2/bike_racing_3d_hack_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://64b67c6e-fbbd-4787-add8-9ed3e274c95c.filesusr.com/ugd/eb6612_3199bcd8e10d4e8ca1937f1d1e32f4df.pdf?index=true
    • http://jipudovisubu.rf.gd/backbenchers_songs_free.pdf
    • https://7211abc3-b26e-437e-abd8-8a8c7ebd4af5.filesusr.com/ugd/0683fb_33f755a907b44991a20b1efe856f5133.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0e75f7df-5ad4-4c6a-a59f-59e214b2311c/how_to_unlock_rca_voyager_tablet.pdf
    • https://4eb83289-b313-4542-b68c-79a1d4783db4.filesusr.com/ugd/f6336d_8423ad7294b74a5baec62b2e3261e4bb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/44c0798a-9e79-49d4-9f62-ec0d908bca57/find_the_volume_of_rectangular_prism_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/64993776-d1e1-48fa-9b10-c97a7b5b6fb3/learning_guitar_chords_for_beginners_youtube.pdf
    • https://uploads.strikinglycdn.com/files/0f4b3b0b-42e6-4c31-a1f3-69e260c26693/gedilafoz.pdf
    • https://uploads.strikinglycdn.com/files/77ba9c2a-a1c3-4326-b322-1b3fce08f71f/zaluxe.pdf
    • https://uploads.strikinglycdn.com/files/5e4baeb2-d26f-4ee6-9275-4c57d10e31b4/42654145531.pdf
    • https://uploads.strikinglycdn.com/files/9207e06d-9b7c-431a-a934-c88ca336bd22/18566693070.pdf
    • http://fokafupu.rf.gd/96149996634.pdf
    • https://ecfc1f44-6648-4072-bff5-6ee4adcfbe4f.filesusr.com/ugd/e5a943_5abe5864391e4f64ab64da4d83534a35.pdf?index=true
    • http://sipisadam.rf.gd/multiplying_fractions_with_whole_numbers_worksheets.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101ea.bin
6b993a67633e28417c7f0c98722a4067b82ff3683354af194b5b0886708e033e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101EA 4096 bytes
font_01_sfnt_off00011049.bin
a879fbd30b9e971de2baff17f74364f948f8b5bec51e90c07d7be10908de8867		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11049 5416 bytes
font_02_sfnt_off000122b7.bin
e9afa8f380433504b94f4a451250a059c4d3e8d97fe65352260d2da99c5d8a19		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122B7 11432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.