Malicious PDF — malware analysis report

Static analysis result for SHA-256 0342101863be8a50…

MALICIOUS

PDF

71.8 KB Created: 2021-05-20 11:28:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 5d45c227517effe863057a41cd8f291a SHA-1: 7a04360e4369a7587fc314fe24cd312b21a78169 SHA-256: 0342101863be8a509ff4bdf952ecb4613b88e645e2d29b2248ce01e21a08b1ec
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=manual+pr%25C3%25A1cticas+de+electr%25C3%25B3nica+automotriz+pdf PDF link annotation
    • https://gidisapawifo.weebly.com/uploads/1/3/4/6/134611794/ce726d9146df.pdfIn PDF document text
    • https://ziruxirunilexa.weebly.com/uploads/1/3/0/7/130775543/vegede.pdfIn PDF document text
    • https://panulozeti.weebly.com/uploads/1/3/5/3/135351273/xujubudobapa.pdfIn PDF document text
    • https://danexuxubusam.weebly.com/uploads/1/3/2/6/132695747/f44fefd43b9.pdfIn PDF document text
    • https://ligapixoxos.weebly.com/uploads/1/3/4/3/134378271/6280728.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/44a91eb6-7317-456d-8fbb-37e9ee793497/what_is_the_meaning_of_artistic_development_in_relation_to_individuals.pdfIn PDF document text
    • https://s3.amazonaws.com/muwomapotumugi/4552163849.pdfIn PDF document text
    • https://s3.amazonaws.com/saziwijaxodav/green_screen_chroma_key_app_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6d06570-5560-4e9d-be6e-abf92ceebdb7/jilumam.pdfIn PDF document text
    • https://s3.amazonaws.com/safenalavojuwu/vumewomufisevege.pdfIn PDF document text
    • https://s3.amazonaws.com/fedufiporara/brown_eyes_sajjan_adeeb_song_video.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf0796f4-3ca9-4cf4-a520-ce29a29a8d56/what_is_a_good_name_for_a_lip_gloss_company.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3692a7f8-9537-48e4-8e47-4236af289dba/devotions_for_married_couples_struggling.pdfIn PDF document text
    • https://s3.amazonaws.com/pasawexawinogad/single_phase_transformer_amperage_calculator.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4464ec8-09ca-4b4c-b8bc-ffc9cef32daf/76965005382.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/reliability_centred_maintenance_john_moubray.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d54cdeae-2b0c-4825-b8cc-7c65b6775bb1/how_to_hack_shell_shockers_eggs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9916af8-7a4d-4718-b858-d158b7963b19/how_to_use_skmei_smart_watch.pdfIn PDF document text
    • https://s3.amazonaws.com/batiku/after_series_book_2.pdfIn PDF document text
    • https://s3.amazonaws.com/pasutiz/tebolaseb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d06a037e-59f3-4394-8299-30578a941e56/pukuwuberud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec902339-ed4d-45dc-b374-0d5711466513/33795608294.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7E1 5728 bytes
SHA-256: 765f22fd6fdfb6f335cb8d9c5bfb6c306d4c9d930006217d07cd9187e9ac24a9
font_01_sfnt_off0000ea86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA86 11340 bytes
SHA-256: 147bc752eb10af39ad3fcf6e1f76d5e6f1fd8a68b50f5bd37849045b4139bdbc

Open this report in the interactive analyzer, or submit your own file for analysis.