Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe6d6a88183c068a…

MALICIOUS

PDF

79.8 KB Created: 2021-05-24 18:21:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: e9e6fcfe99dcf537193e4d09330766ed SHA-1: f5957d2c50d3b48a5033a23e1b4429ff967522d6 SHA-256: fe6d6a88183c068a21713ab723dea6995c36775e99bdd5c4a77919830a04f319
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO poisoning tactic. The primary URL observed is `https://bologen.ru/strik?utm_term=diferen%25C3%25A7a+entre+bases+purinas+e+pirimidinas`, which likely serves as a distribution point for further malicious content or phishing attempts. No scripts were extracted, but the structure and URL patterns strongly suggest a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=diferen%25C3%25A7a+entre+bases+purinas+e+pirimidinas PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4383795/normal_606c8dffce976.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387929/normal_5ff712a7e95ef.pdfIn PDF document text
    • https://fefirewaw.weebly.com/uploads/1/3/0/7/130775199/1779641.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470553/normal_5ff551d3dde0b.pdfIn PDF document text
    • https://tedofejufada.weebly.com/uploads/1/3/0/7/130775935/pepegasibepe_nemexudamuzajug.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487618/normal_6034cf21613bb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465125/normal_5ff545c355884.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388285/normal_60049d3141205.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447280/normal_5fc7e16bc67df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414159/normal_606b51b1364dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455684/normal_6023ed20704e2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402507/normal_60601e4e63222.pdfIn PDF document text
    • https://bipixexomalexu.weebly.com/uploads/1/3/4/3/134349320/powen.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484818/normal_5fe432ec8686e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449424/normal_600c794bc251f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421770/normal_604ba7a500ce4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486346/normal_5fda94543608b.pdfIn PDF document text
    • https://kogovuvukadag.weebly.com/uploads/1/3/2/6/132682039/rijuso_gupur_repedefadox_muninipinurojed.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kaxukok/high_school_reading_comprehension_passages.pdfIn PDF document text
    • https://s3.amazonaws.com/luxelula/2005_jeep_grand_cherokee_laredo_lug_pattern.pdfIn PDF document text
    • https://s3.amazonaws.com/neviwove/donaldson_oil_filter_cross_reference_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/zexozavo/76382772123.pdfIn PDF document text
    • https://s3.amazonaws.com/kesumasaka/brian_head_trail_map.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3BF 5476 bytes
SHA-256: f5292fd5929e61137418db960ff6f1ba3d06659fff4d81be71e126fb0503d714
font_01_sfnt_off0001064b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1064B 13516 bytes
SHA-256: fffbfaa7b3959c5f6d192ea8a0ee24c874dd2cc3726069a216bcfceeaaec70eb

Open this report in the interactive analyzer, or submit your own file for analysis.