Malicious PDF — malware analysis report

Static analysis result for SHA-256 034668935440f070…

MALICIOUS

PDF

123.9 KB Created: 2021-03-10 17:05:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f369bdb89ffec59bbe08db3b53562221 SHA-1: c1535d66d7929c1cf7d8c5182c28817278b81021 SHA-256: 034668935440f0702b7a6e1d8dfc3840d0ee75a62273198623f041e0eae91366
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9715

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=pcr+polymerase+chain+reaction+virtual+lab+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4426075/normal_60378ddc59ae9.pdfIn PDF document text
    • http://inglassrus.ru/jam_replay_bluetooth_speaker_instructions9d9rd.pdfIn PDF document text
    • http://businessoutsourcing.info/770719290925f3y2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450419/normal_60251ce01acef.pdfIn PDF document text
    • http://koteyarn.moscow/adafruit_io_android_appdnsgm.pdfIn PDF document text
    • http://fsbsiod.com/fegisasqrl0.pdfIn PDF document text
    • http://crispyset.online/south_african_afrikaans_moviesjv9nb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384304/normal_601fff36dfda0.pdfIn PDF document text
    • http://teleporttur.ru/manual_de_informatica_juridicalycii.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/nitidadufetenu/psychrometric_chart_calculator_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a14fa137-3154-4855-8e6d-eb0c2c436370/nujukowaxusumuxofakimo.pdfIn PDF document text
    • http://kexeban.rf.gd/dofuvaduzebidezekutenu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24f6032c-ff12-4392-8c67-a04bb3b626dd/79637907299.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1693ae05-97fb-4133-8789-bcacf274dc8b/expert_card_technique_third_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b84c6bf7-2032-48ef-ae27-a8b60d4ac0da/vanafunigunegadaselikeso.pdfIn PDF document text
    • https://s3.amazonaws.com/wazagidonux/razikebanezanomo.pdfIn PDF document text
    • http://dokedupaguxo.rf.gd/70295505313.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c63f1e32-ac1c-4919-b4df-a05c551a2ba1/silexikubawikodegixu.pdfIn PDF document text
    • http://dizibabazuvuxu.rf.gd/wupolakudavidabawidenig.pdfIn PDF document text
    • http://nipofoxi.epizy.com/monafafinogidadi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.orgIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_014_off00019eca.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19ECA 19380 bytes
SHA-256: 0610495c1e1df7af31d0204bd439431dce13284cd4e0becc3e48c054096284cd
font_00_sfnt_off0000d645.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD645 6484 bytes
SHA-256: ff8a3ca0a9dc70c67f45efeb5af882a46f7c8d0d38f20bdefbbe0de2c046c8c2
font_01_sfnt_off0000eca9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECA9 5568 bytes
SHA-256: 5c6f7b7671e2c5170b672320bb6d058a56de5679001c214c4f448a3144e958cf
font_02_sfnt_off0000ff7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF7E 2656 bytes
SHA-256: dbaab8dcf32bfe64cb008f34eb54f5316f62236e8dffe3de49b44225404383a5
font_03_sfnt_off00010a80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A80 4140 bytes
SHA-256: 119132d4d86df12b64aacef50f1aeac69cc60fdd8dbe27b6e2ceb22654f0acbc
font_04_sfnt_off0001179d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1179D 3048 bytes
SHA-256: 1b68eb0745f369bd9f805b89718582bd6ebaf917deeaaae5095027b3f32dc7b8
font_05_sfnt_off000123a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123A4 4544 bytes
SHA-256: c6e7aeb80bda8022b0399df6f8693633794be1e3de2912b949a7af661e74256f
font_06_sfnt_off000131a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x131A9 2328 bytes
SHA-256: c42118b51b061dffbc196cd4866a2cf76d9f31ae9d0a8f6c06e6ad224a677b24
font_07_sfnt_off00013c60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C60 2604 bytes
SHA-256: d07a9fdf75b1e191e7a1ea25e2941b9f689ff98e7e435169aef8b5fb7be41b17
font_08_sfnt_off00014777.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14777 2108 bytes
SHA-256: 806d12f4c18e044784d20764d58024893796e88f204c306662924b3e907cbcac
font_09_sfnt_off00015115.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15115 3840 bytes
SHA-256: 5b8e8035f8940535bfb5f3d78de7d5c45dbc51c905faa5d9788b8fc152e96872
font_10_sfnt_off00015f25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F25 6148 bytes
SHA-256: be38186c9256ba0e64b07d34cca2e63b176d3ffd182ae4667a642b503e748fe0
font_11_sfnt_off00016f0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16F0F 16476 bytes
SHA-256: 205c6057624735b410bf74a12b793f5323eff1b056a8674897d72b7dc4086fe8
font_13_sfnt_off0001c037.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C037 3612 bytes
SHA-256: d75de7f8998a40e9b6c9796c168e443e1132a1e4e205912403014502102ac4fc
font_14_sfnt_off0001ce55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CE55 4216 bytes
SHA-256: 75134b945a4a9dbb8ce77b797e7f472ce2c82461d1228df2e7083c6e6f47270e

Open this report in the interactive analyzer, or submit your own file for analysis.