Malicious PDF — malware analysis report

Static analysis result for SHA-256 0070b2a102f76fe0…

MALICIOUS

PDF

76.3 KB Created: 2021-02-26 01:56:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 71c49d011f848c6a88896c96fc52ef54 SHA-1: 999a7ba9387f1df1f60563b588fc9f349b56c59c SHA-256: 0070b2a102f76fe0db6bd3456c43af8cf121f61320ac2f8244bef5367dc2e7b5
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for an external URI pointing to a suspicious domain, likely intended for phishing or SEO spam. The PDF also contains a large number of external links, many of which point to other PDF files, suggesting a link farm or content stuffing tactic. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9109

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=what+does+viking+runes+mean PDF link annotation
    • https://xunuvetokogira.weebly.com/uploads/1/3/1/3/131384336/9769393.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384307/normal_5ffa84fce9fd9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377113/normal_5fe50605437a4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459055/normal_5fc5cbc57dedf.pdfIn PDF document text
    • https://kodopikowi.weebly.com/uploads/1/3/4/6/134659436/94bb472b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417834/normal_5fcd3cf169223.pdfIn PDF document text
    • https://waxevinibiwe.weebly.com/uploads/1/3/0/9/130969944/gurerili_jonesud_febaxujoluzud_ruzowibox.pdfIn PDF document text
    • https://cdn.sqhk.co/voxoduvi/phdiiha/knife_scrape_sound_effects.pdfIn PDF document text
    • https://taleputara.weebly.com/uploads/1/3/4/3/134305900/vinap.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380411/normal_60291cb29e9de.pdfIn PDF document text
    • https://cdn.sqhk.co/vovawumusa/ngdjfjf/vuduxoxaveluvovapikiwa.pdfIn PDF document text
    • https://cdn.sqhk.co/zanemulazif/2ghFjhq/jovusatowi.pdfIn PDF document text
    • https://cdn.sqhk.co/definuseju/UDiiQgj/pokemon_cards_gx_mega.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4500187/normal_6005b8ad20f47.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kudowo/dolanulebema.pdfIn PDF document text
    • https://s3.amazonaws.com/kavugusepe/gisizuwejawakowarezatu.pdfIn PDF document text
    • https://s3.amazonaws.com/leteraxewe/genoxiwifikabuf.pdfIn PDF document text
    • https://s3.amazonaws.com/somisilegex/zijawizinel.pdfIn PDF document text
    • https://s3.amazonaws.com/fizup/cpf_annual_report_2016.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010142.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10142 5344 bytes
SHA-256: d2c8c8b7be5921554ec59e04b20e37329f37e7173eabd146fd3a88f8cf9ccd9e
font_01_sfnt_off00011316.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11316 6248 bytes
SHA-256: 8bfd78da957245712ac4f79bf34c50ee382c59d5719b00a4bfea58c72054b400

Open this report in the interactive analyzer, or submit your own file for analysis.