Malicious PDF — malware analysis report

Static analysis result for SHA-256 0933c8fbf4e093d9…

MALICIOUS

PDF

78.4 KB Created: 2021-03-15 23:35:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: d79f8aca88981a252374b7ca0b0e2ef6 SHA-1: bb98bd83c8dbdc040cfa9c71d79aae2a45c258ff SHA-256: 0933c8fbf4e093d9997abfbe5be3b9f4ca74aa13593596aacb8dbf200b99919f
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with several pointing to suspicious domains and one identified as a link farm on disposable hosting. The presence of these links suggests the document is designed to redirect users to potentially harmful websites, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=cara+manual+brewing+v60 PDF link annotation
    • http://testrun.ru/keurig_2.0_carafe_setting_not_workingtnwsj.pdfIn PDF document text
    • http://rukozhop-guide.com/the_appraisal_of_real_estate_free_download7unmz.pdfIn PDF document text
    • http://immorta-cross1.club/jufan2vc9v.pdfIn PDF document text
    • http://petersikdar.com/at_what_time_does_burger_king_breakfast_endzxxw8.pdfIn PDF document text
    • http://fbcopyright-center.com/putuzorevawafisujewifirjd7m.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370071/normal_5fce809660148.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368246/normal_60209a04303c1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451545/normal_6004d8fe7c254.pdfIn PDF document text
    • http://antonioit.fun/city_car_driving_game_car_simulator_games_3d02cif.pdfIn PDF document text
    • http://mybatut.store/nobodies_murder_cleaner_hack_apk0x9xc.pdfIn PDF document text
    • http://bovewowi.iblogger.org/mails_blockieren_android.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459469/normal_5fd703622e2e1.pdfIn PDF document text
    • http://junemam.22web.org/calendario_2020_para_imprimir_com_feriados.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lakujusitejojet/kanban_board_in_excel_template.pdfIn PDF document text
    • https://s3.amazonaws.com/jejulurowev/what_is_the_rarest_human_mutation.pdfIn PDF document text
    • https://s3.amazonaws.com/lekelepowo/jivisuvafuwidiwurabezup.pdfIn PDF document text
    • https://c63ca81c-6df4-4ec3-bc2e-8508f29a6879.filesusr.com/ugd/d48fe3_a4c0ee25e0ed4571bd4788c039a814e2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pusolefosex/mafixarum.pdfIn PDF document text
    • https://92ddf5cc-4ce7-4caf-b117-8241c553a727.filesusr.com/ugd/42bae0_c41066a01d3143babc379131c379e846.pdf?index=trueIn PDF document text
    • http://raxezebob.rf.gd/81863260467.pdfIn PDF document text
    • http://wokasob.rf.gd/13471072181.pdfIn PDF document text
    • http://gewarimaliv.rf.gd/les_noms_des_animaux_en_francais_avec_photo.pdfIn PDF document text
    • https://s3.amazonaws.com/mijumomub/pajobunalumawaluwuj.pdfIn PDF document text
    • https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_0a598ff234c14bb7b83f9387ba660890.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5AC 5320 bytes
SHA-256: 08a20f330a30d3fd9cf2c595d7374b9d82765311fcd3ed9968db5e859e00b873
font_01_sfnt_off000107c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107C5 10536 bytes
SHA-256: eedbd91a26dff69f94597709f20f3dced23549313681e3b7eb49bcb0d7e6ece7

Open this report in the interactive analyzer, or submit your own file for analysis.