Malicious PDF — malware analysis report

Static analysis result for SHA-256 08172913839bdeae…

MALICIOUS

PDF

84.2 KB Created: 2021-05-14 15:27:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6cda3cbe05c66d0cc1e98fa439fc04f2 SHA-1: 676ac1b789e5661f920f4b22d1cc8a7263e971b8 SHA-256: 08172913839bdeaee4c8b0238b5a5ab3b41dc3d24a9ae722b962208c1439ca88
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which are hosted on disposable domains or are part of a link farm, indicating a malicious intent to redirect users. The ML classifier and ClamAV detection strongly suggest malicious content. The document body, though heavily obfuscated, contains text related to a 'Kenmore elite 41072 owners manual', which is likely a lure to encourage clicks on the embedded malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=kenmore+elite+41072+owners+manual PDF link annotation
    • http://kawopewil.22web.org/ehsaas_old_movie_songs.pdfIn PDF document text
    • https://teselabobebivu.weebly.com/uploads/1/3/1/6/131606188/89283.pdfIn PDF document text
    • https://nowimadowa.weebly.com/uploads/1/3/4/7/134705132/leretuvo-poxek.pdfIn PDF document text
    • https://mewasopaligesar.weebly.com/uploads/1/3/1/4/131454012/7953762.pdfIn PDF document text
    • https://cdn.sqhk.co/lomasamube/ihjjFgh/plex_remote_for_ios.pdfIn PDF document text
    • http://fibubomalinod.22web.org/11724699621.pdfIn PDF document text
    • https://cdn.sqhk.co/tamejenonisi/cjgidgh/xidavixedowixi.pdfIn PDF document text
    • https://zanijiwudiv.weebly.com/uploads/1/3/5/3/135349447/8721672.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/children_s_place_uniform_shirt.pdfIn PDF document text
    • https://2c549fd3-bbcc-4e43-aea5-84609313cfd4.filesusr.com/ugd/c162b3_2408d0294d8544ceab31b7624a90af0e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dcd6a474-306f-4a24-9b42-d4268abdb900/17364573231.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/083337be-352f-4a7f-8ec5-cba5e6e50d4a/sexaver.pdfIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/free_non_verbal_reasoning_tests_for_11_year_olds.pdfIn PDF document text
    • http://rinifujojutot.epizy.com/zazasijetonuxilusuki.pdfIn PDF document text
    • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_b73a3b681d1f4b7bb085f287101186d1.pdf?index=trueIn PDF document text
    • https://43466d02-873c-4564-b63c-f2f79aa6d38e.filesusr.com/ugd/fd64e8_b65e24995a014d40aa6333a0d3d96bef.pdf?index=trueIn PDF document text
    • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_ab0644a56259486ba096261eac913cef.pdf?index=trueIn PDF document text
    • http://jiporeve.epizy.com/m50_gas_mask_carrier_nsn.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a3b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A3B 5384 bytes
SHA-256: d73d860553574a78e2399de6a43d265e8a0047d2a3bf0219eb77c23441e6e4d6
font_01_sfnt_off00011c9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C9A 11684 bytes
SHA-256: 8d0740a65202ae3ed2a068d0ea3fe99293b0dfe6ec39f014357875d41d9a964e

Open this report in the interactive analyzer, or submit your own file for analysis.