Malicious PDF — malware analysis report

Static analysis result for SHA-256 079b9cad38007190…

MALICIOUS

PDF

104.2 KB Created: 2021-03-30 07:40:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: d4b1b428dc5e98a30f24465adcc78e16 SHA-1: 80a8566e2475e4fac5e0e9c2caceaae7435eaad8 SHA-256: 079b9cad380071901bfb598d7768e953980dd9fcd07293e8871847b869c3ba89
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=coca+cola+amatil+annual+report PDF link annotation
    • https://japapetokanov.weebly.com/uploads/1/3/1/4/131454126/a47965157.pdfIn PDF document text
    • http://kikifikoxije.mypressonline.com/xazidorasam.pdfIn PDF document text
    • https://numojuwavusori.weebly.com/uploads/1/3/4/7/134728722/8700542.pdfIn PDF document text
    • http://terugate.mypressonline.com/2035263763.pdfIn PDF document text
    • http://dibiwarisogix.mygamesonline.org/innovation_and_entrepreneurship_peter_drucker.pdfIn PDF document text
    • https://pasetesosetoje.weebly.com/uploads/1/3/0/7/130775590/880904.pdfIn PDF document text
    • https://gubulugovidenu.weebly.com/uploads/1/3/1/4/131406252/rizemuwoxujenox.pdfIn PDF document text
    • http://niluwipewuxasa.medianewsonline.com/capitulacion_de_toledo.pdfIn PDF document text
    • https://wawowipibi.weebly.com/uploads/1/3/3/9/133997364/fuwap_gebop_dijibokodupak.pdfIn PDF document text
    • https://wejumarokurefa.weebly.com/uploads/1/3/0/7/130776247/9417417.pdfIn PDF document text
    • https://revugegan.weebly.com/uploads/1/3/4/6/134682990/e71be08671d76.pdfIn PDF document text
    • http://decideyouself.fun/gmail_inbox_for_pci05ca.pdfIn PDF document text
    • https://denelabi.weebly.com/uploads/1/3/4/1/134109088/2764609.pdfIn PDF document text
    • http://organic100.fun/zuwuwipufobabebedozin33g34.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jeponowon/amaranth_font_free_ttf.pdfIn PDF document text
    • http://siniligavaxuvul.onlinewebshop.net/31969364106.pdfIn PDF document text
    • https://s3.amazonaws.com/bidemewufa/pectus_carinatum_bodybuilding_transformation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fae36f7-9e91-4833-8036-e4201b5c32fa/bepawe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/860aafaf-517c-463b-adb9-d9199a263267/why_i_am_not_a_hindu_book_review.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015bd4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15BD4 4804 bytes
SHA-256: 387b3b667d04f247b99006140830874568da4e30a0db0c120c110da41e0e7c7a
font_01_sfnt_off00016c0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16C0E 11836 bytes
SHA-256: 6382d6999ba20cb7deb7d754c935c6cb42b74340c70578b8f6545429d053a0c5

Open this report in the interactive analyzer, or submit your own file for analysis.