Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a94cb30ef7f43b6…

MALICIOUS

PDF

78.1 KB Created: 2021-04-16 19:51:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: f04e84a1f9bfa609b4b48ce73934cafe SHA-1: 860d044db8707cc8e67b99362cde5ec828b18099 SHA-256: 0a94cb30ef7f43b6dc91d6e799ca1b3a5cc2d33e8bc14e7623d1ebefbd02aa6f
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with a critical heuristic identifying a link farm. One prominent URL, 'https://soxebez.ru/strik?utm_term=how+to+get+gold+marvel+contest+of+champions', suggests a lure related to a game, likely for phishing or malware distribution. The presence of embedded URLs and a high ML classifier score further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=how+to+get+gold+marvel+contest+of+champions PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4416666/normal_6063605aea8dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4498330/normal_606bed18d6974.pdfIn PDF document text
    • http://kojurebajalafaw.22web.org/dunowejakeg.pdfIn PDF document text
    • http://pifibunevivumo.iblogger.org/tutorial_drawing_anime.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pavujiniz/23384886757.pdfIn PDF document text
    • https://5e6d3f51-9b35-4a29-baf4-1f036254a461.filesusr.com/ugd/99a8f2_d434d7248aff4ef08c92ed56b7f52e47.pdf?index=trueIn PDF document text
    • https://84d5b3ab-51dd-4312-87b7-51df18fb3b26.filesusr.com/ugd/9ea9b6_4419c484612f4689b9a935176b168062.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/divikufifir/how_old_is_ahsoka_in_star_wars_the_clone_wars_season_7.pdfIn PDF document text
    • https://s3.amazonaws.com/bisapovepizaj/hp_elitebook_folio_9470m_lcd_replacement.pdfIn PDF document text
    • http://dikumetuvo.epizy.com/gorinilikotenabuj.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/moravuridexosa.pdfIn PDF document text
    • https://s3.amazonaws.com/jedadokuti/what_can_cause_an_engine_to_surge.pdfIn PDF document text
    • https://0ffdd24b-620b-4f4d-94ef-a39da1ca20bd.filesusr.com/ugd/853ce2_799be8262eca457faf2c7db480723ee8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbc2b76d-09c2-406c-9ea4-4d4fbd6106c5/what_is_22_carat_gold_rate_today_in_surat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4351e86-4ec6-459a-a4d1-fee609bce7f2/how_to_make_a_health_and_safety_plan.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/tavobibaxagudon.pdfIn PDF document text
    • http://lexupanerosexa.epizy.com/55631846499.pdfIn PDF document text
    • https://d7179dab-c972-4501-9f4a-16044ca71e84.filesusr.com/ugd/434f74_565877de1a714aaa8eb894c4a69bfdb8.pdf?index=trueIn PDF document text
    • https://1f8834b3-47ac-4b28-85e6-f0b449c9ddf7.filesusr.com/ugd/4cd51e_60f3cf28f0ce4df2ae7148b1a4ad2352.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7acaab2d-6bb8-4ab2-b8b5-074618479f9a/do_androids_dream_of_electric_sheep_chapter_2_analysis.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/wutatipazex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54aa9c60-0c9b-4944-8ea6-e88cd8a79d86/62334528448.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f246933-3750-4acc-bb21-8348c79f0f6a/72489429234.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F4 5680 bytes
SHA-256: 5bb596469866d2e437ae95ab344064774c52f08c8b6e551207700cb6bfcf75ac
font_01_sfnt_off00010539.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10539 11104 bytes
SHA-256: e624778ea449b8bf248c70c62eb58b116ba1b38c1833fa2a557c8a6eea90eff2

Open this report in the interactive analyzer, or submit your own file for analysis.