Malicious PDF — malware analysis report

Static analysis result for SHA-256 014cd807103b9fe2…

MALICIOUS

PDF

82.3 KB Created: 2021-03-25 02:15:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: c0d940542f500c7c2e271b4a4624b348 SHA-1: 5adea6eadca5ffaade620be4453884b37fcca51c SHA-256: 014cd807103b9fe29f895b8f8f02380f61af6cb2a73bb92e371a317ce4ba5425
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=technivorm+moccamaster+coffee+maker+vs+bonavita PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4382620/normal_6037a8e5459cf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4407795/normal_600747939ff81.pdfIn PDF document text
    • http://kutejovanog.getenjoyment.net/l_abcdaire_de_gilles_deleuze.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420448/normal_60462f29cfb73.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424400/normal_601eaa4bf1ae9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481275/normal_5fc6a7dda5333.pdfIn PDF document text
    • http://salonly.xyz/steel_modulus_of_elasticity_in_n_mm2o7lv6.pdfIn PDF document text
    • http://napodosawukezob.getenjoyment.net/sibar.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422637/normal_5ff7bb7019726.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421478/normal_5fe7311e364da.pdfIn PDF document text
    • http://winoraama.fun/beekeeping_free_download2rs3p.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375700/normal_604b208c0fcfc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/60174789-887f-4eee-b902-d71c1ac80ec5/how_to_use_smith_knife_sharpener_coarse_fine.pdfIn PDF document text
    • http://wenulusevikofa.myartsonline.com/download_tulisan_asmaul_husna_dan_artinya.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44960a69-87e3-4658-b6a2-79642261c92e/vusinek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24fb5906-0d66-44e1-912a-cc3183b10be3/sakulezovuluxaboteno.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c120f8c-ffbb-4e0f-a9c2-253d4c629ea7/reasoning_ability_questions_and_answers_for_bank_exams.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2452d8ca-ef76-4cf1-b08e-cd925695221a/66238882443.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36b91964-fd20-4b65-8664-06a0e952acbb/forazabejasijazidalola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88050fc7-85f5-440b-9119-73f1a8df93d0/raynor_garage_door_opener_manual_model_170-7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20ceac56-6e71-421a-9fd1-1dbdc83c802b/focusrite_scarlett_18i20_software_bundle.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001057d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1057D 5304 bytes
SHA-256: 2d87e6365978156fdca57010ba20fedb7af0973921428abda9077b38007bfc02
font_01_sfnt_off00011764.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11764 10684 bytes
SHA-256: b7c1866babce490cd39001c512b89fcf2b9db37736a1287253134074b7e0edeb

Open this report in the interactive analyzer, or submit your own file for analysis.