Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5c5a3d315f528df…

MALICIOUS

PDF

89.3 KB Created: 2021-05-20 16:58:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 1e2c2aa168632d46f479b2d1828ea544 SHA-1: c0490e93d7c97d254a1112cb89a5482cd6af1fd2 SHA-256: f5c5a3d315f528df28cbe104f8fcc07bd9f43091a34d5ad4f53a6c64aa17d046
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, with heuristics indicating it contains an external URI and an SEO redirector link. The primary URL, 'https://bologen.ru/strik?utm_term=bleu+roblox+exploit+download', is associated with a phishing lure for a 'roblox exploit download'. Although no scripts were explicitly extracted, the PDF structure and the nature of the URL suggest it is designed to trick users into downloading a malicious payload, likely through a phishing or social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9905

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=bleu+roblox+exploit+download PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4403804/normal_60605f937703a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447646/normal_605db6bf8830d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412902/normal_5ff3c0f650ccb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475212/normal_5fff34ef84464.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369665/normal_5fcb4ae150824.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mivokozibu/54442190195.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/xunudafebofewuz.pdfIn PDF document text
    • https://s3.amazonaws.com/rurosaveruk/christian_video_songs_mp4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aab1647f-58d7-4364-a10d-c85c9dbdff4e/que_es_una_composicion_escrita.pdfIn PDF document text
    • https://s3.amazonaws.com/napejaxosinages/artificial_neural_networks_and_fuzzy_neural_networks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/665e42d1-06aa-46a5-9629-96e5d7580eba/where_is_the_battery_located_on_a_2006_dodge_stratus.pdfIn PDF document text
    • https://s3.amazonaws.com/silubebebefuju/17214274695.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7537d98c-69d1-47b7-a4bd-315ae5597084/how_much_does_the_average_straw_bale_weigh.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/270f163d-cb4b-4246-a722-cd1d31050f2b/how_do_i_create_my_own_website_from_scratch.pdfIn PDF document text
    • https://s3.amazonaws.com/zabevog/black_and_decker_automatic_bread_maker_b2300_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/zatasipezeg/29431898920.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42ea4216-b844-4a7a-8457-9e3dbb092455/what_are_the_types_of_structure_in_the_medieval_period.pdfIn PDF document text
    • https://s3.amazonaws.com/wifukedot/41078186698.pdfIn PDF document text
    • https://s3.amazonaws.com/nemafu/traffic_report_on_m5_bristol.pdfIn PDF document text
    • https://s3.amazonaws.com/tufitijinexu/life_fitness_95t_elevation_treadmill_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/xisudejuxor.pdfIn PDF document text
    • https://s3.amazonaws.com/negonanopix/cannery_row_john_steinbeck.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5b372f1-583f-4fa0-9808-14bc2099347a/80000598608.pdfIn PDF document text
    • https://s3.amazonaws.com/sefabe/14943698713.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d6e26a3-8482-4138-931c-2384c1b17923/big_short_investor_warns_of_bubble.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/057f4f6a-ff6c-4f83-8d24-95aaa1b0b207/meaning_autonomy_ethics.pdfIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/bose_wave_music_system_bluetooth_setup.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB0B 6904 bytes
SHA-256: c1ccedbf72f47b6219e27de0a7a6c3d32c8a4c3a509451b8e73eb1bc96f8e6de
font_01_sfnt_off0000fca4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA4 5124 bytes
SHA-256: f58ec3d1df49152f00b5843c3f1a8f4dd5dc9572baf979d9cf69f84b377438b1
font_02_sfnt_off00010e29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E29 1772 bytes
SHA-256: b44234b99998f6faa0297193f745ab57bbfde2d736c89d064edb68d8857b7b3f
font_03_sfnt_off000116a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116A3 12780 bytes
SHA-256: ab6eaf2d424c48b46d2a1f580d938d91dea3713335e7d8b7a3a8e965ad4817b3
font_04_sfnt_off00014090.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14090 16320 bytes
SHA-256: 6fcb839bdfef6cc4010779039da682246d9820a7f29ca5ecf21913c4ad560b89

Open this report in the interactive analyzer, or submit your own file for analysis.