Malicious PDF — malware analysis report

Static analysis result for SHA-256 de9c11602b62baff…

MALICIOUS

PDF

113.6 KB Created: 2021-03-31 06:34:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b307eb252618436c5d0484e4c621cb8f SHA-1: d2fb3baa7c82570a298b4a552aaee007a04ac407 SHA-256: de9c11602b62baffe01311a5ca546cababdcdbb3dcc091bd239a182d3a182f1a
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. One prominent URL, 'https://bologen.ru/award?keyword=metro+map+delhi+pdf+latest+2020', suggests a lure related to search results. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware. No scripts were extracted, but the sheer volume of outbound links points to a link-farming or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=metro+map+delhi+pdf+latest+2020
    • https://cdn-cms.f-static.net/uploads/4489844/normal_60164db6322bc.pdf
    • https://tetegewa.weebly.com/uploads/1/3/4/7/134761184/tepuvisaxosu-wopulosa-duwefewoxoduk-vejokenavigojap.pdf
    • https://cdn-cms.f-static.net/uploads/4409113/normal_6047f2e5a7b02.pdf
    • https://static.s123-cdn-static.com/uploads/4456671/normal_5fdcec709aa5d.pdf
    • https://cdn-cms.f-static.net/uploads/4454421/normal_6048cd80ca69d.pdf
    • https://cdn-cms.f-static.net/uploads/4469640/normal_6058a3c45ae60.pdf
    • https://tumuzisokume.weebly.com/uploads/1/3/5/3/135351536/6d8f7b94b28.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2a07c75e-e898-48ba-b326-4cccc82d0599.filesusr.com/ugd/ff154e_407b7710b46e4ee398cc824e5ec866c6.pdf?index=true
    • https://4c2674ec-1430-4cec-a455-d6a35d10586e.filesusr.com/ugd/38955b_902082a394884cf0b8dcd2c650c3406a.pdf?index=true
    • https://a50dbba5-e4fd-40cc-afa9-a45495a5accf.filesusr.com/ugd/7f929b_5431e36f62814b779539496a3e109395.pdf?index=true
    • https://5e446c31-fcb6-4427-a178-91ee45bbff8b.filesusr.com/ugd/4e76b8_d74c689a704f4825a3f737b27c8218e8.pdf?index=true
    • https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_7683e36b3d1247afb4a32ba088fb039c.pdf?index=true
    • https://856cb5e6-6c81-45ce-9604-b57907a15cd2.filesusr.com/ugd/cc3ca9_ee2f656fccde4120b99f63ffb1d79c99.pdf?index=true
    • https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_2027ca20b2a5442e953e20274fe2b72b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bff79371-7e60-4fac-8d40-6bc1942c70da/safomisirelifevuxakem.pdf
    • https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_70a34821105148b188548fb19aff0257.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e9f3f321-0ef2-445b-94a2-46806546cc86/wokini.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00017f25.bin
af367de34c5f7c9930029e2e0d6f522e1b131e24d927228fe3cbbacdac169289
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x17F25 20112 bytes
font_00_sfnt_off0001455c.bin
a575b1fb7408298017770fbc9772f59fa0109340ebeb4d558b59b419fb249b88
pdf-font-stream PDF embedded font (sfnt) at offset 0x1455C 5560 bytes
font_01_sfnt_off00015821.bin
52e9135f085a99de807d48abe6d8faa64b2085dd1d7348ecd3a87ef90f0d2650
pdf-font-stream PDF embedded font (sfnt) at offset 0x15821 11320 bytes