Malicious PDF — malware analysis report

Static analysis result for SHA-256 06eb6eb0ef48553b…

MALICIOUS

PDF

71.3 KB Created: 2021-03-12 04:07:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: cec7a08c81e196b45a4fe454ccdc2e5b SHA-1: 5e41f93ca310590c4b8b43cbd52691c9c7c8b5d2 SHA-256: 06eb6eb0ef48553b9638e5c7122d909c1fde494cce2e99a3aae529b6b0e84c6f
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=aprendizaje+activo+mel+silberman+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4383304/normal_5fc7facb160d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408851/normal_601f8416c454f.pdfIn PDF document text
    • http://icily.xyz/craftsman_yt_3000_attachmentsp6zub.pdfIn PDF document text
    • http://tagoturuluro.medianewsonline.com/penny_stocks_list_2020_december.pdfIn PDF document text
    • http://sibatike.getenjoyment.net/22246869583.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380869/normal_6041ffcf711e3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455901/normal_5febd0016d39e.pdfIn PDF document text
    • http://s-tochka.ru/69997472846wfepd.pdfIn PDF document text
    • http://allostar.buzz/19505761748g2exn.pdfIn PDF document text
    • http://tepugorotewole.medianewsonline.com/91710098668.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366400/normal_5ff3b32ac71dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478933/normal_60282dab25b42.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415309/normal_5fc5d4198cbc2.pdfIn PDF document text
    • http://ylyn.ru/little_sas_book_download7f6p6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405639/normal_604891b35c8d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451377/normal_5fd9cf0519175.pdfIn PDF document text
    • http://pexulisinipev.sportsontheweb.net/definicion_de_acoso_escolar_segun_autores.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454289/normal_6014332a654c7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_df478b1b0b154e12a59f270dbaa0573b.pdf?index=trueIn PDF document text
    • https://f55c6975-0091-4942-a106-dc80285e5f9d.filesusr.com/ugd/8a4248_f5c1a94be8cc471f9a42ab9c87fd6b43.pdf?index=trueIn PDF document text
    • https://35e1cc1d-5f6c-4a41-9b1b-b9ae8dddc97a.filesusr.com/ugd/351eee_51ba791293ac42c3ad8e999c66a200fb.pdf?index=trueIn PDF document text
    • https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_7e70eaea310b4a44a8196402c56fca1a.pdf?index=trueIn PDF document text
    • https://5c2df1de-05ea-4e17-9aa3-38adc7ce3153.filesusr.com/ugd/ddd609_a2edfc19b20f4a2e8e492dcdfb6515b2.pdf?index=trueIn PDF document text
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_301211aef6d842c89abc3d3451202005.pdf?index=trueIn PDF document text
    • https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_3015e293be9b4477803ec2a9f9a59ad1.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d567.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD567 5616 bytes
SHA-256: 30dbc99f916d34e4691bcb38177b91a8a2fd50aef572617ca94c8cfb0c68d396
font_01_sfnt_off0000e879.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE879 11556 bytes
SHA-256: cf44b2de01499eaba5eefb76244f4104d008f45d4967de23fed70235f6560664

Open this report in the interactive analyzer, or submit your own file for analysis.