Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bed86ab2bdbca90…

MALICIOUS

PDF

68.1 KB Created: 2021-03-17 23:07:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f954772040e358311013714bcec772da SHA-1: a40f84b433f0ed26e459695d980e7ef76027e785 SHA-256: 0bed86ab2bdbca90a5b6acd62accaf381be2b70647736624db790878722b88db
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8381

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=astronomy+magazine+august+2020+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d27689eb-5a96-4f49-ad1d-b2bb6e8b4f2f/50513397564.pdfIn PDF document text
    • https://ec08fec6-e576-400d-8504-372613838d3c.filesusr.com/ugd/57e0ce_91264f9486d34b42acec5df50a0b1bf7.pdf?index=trueIn PDF document text
    • https://5f384421-c3d0-4b4c-85a6-d3745974446f.filesusr.com/ugd/40006b_06385b1652c24803997facd0cf1b48a5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cf686ab-62de-402d-92b0-a6c8bc813ad1/what_is_the_initial_velocity_of_the_particle_v0.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e07140c-5cb3-4f29-96dc-c16f050d5e8b/6427117120.pdfIn PDF document text
    • https://2e81f42f-67f9-46a9-89e2-a5f3ab3b03ee.filesusr.com/ugd/f138f5_75d26b56e73b404e9e1c8962763b861a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/0078f370-ef6f-4891-9fae-a3d3aa7bce64/latin_library_ovid_metamorphoses_book_8.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ad96b72-458b-4c52-9628-3a43d464816e/72942915602.pdfIn PDF document text
    • http://vabizawez.epizy.com/allah_99_names.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0552dbe5-0431-4baf-9976-49a127fd07a1/their_eyes_were_watching_god_chapter_11_quotes_explained.pdfIn PDF document text
    • http://zufewutakukaluk.rf.gd/chrome_allow_out_of_date_flash.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8369832-ed39-476b-9799-b93cce16f8bd/the_world_until_yesterday_amazon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32a8b958-98a1-4825-98c3-2c31edd098b1/baledozobegesosunujera.pdfIn PDF document text
    • https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_70724757767542f8a0a2db902b71442a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e91c15a-a77a-4882-b6df-e07228adf3ec/9727677978.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0d80d72-1b33-402d-b083-368b68c36fff/can_i_connect_logitech_keyboard_without_receiver.pdfIn PDF document text
    • http://dabemekos.epizy.com/open_appendectomy_steps.pdfIn PDF document text
    • https://f0f855fd-29d2-4bf6-9fdd-af1de8d1f91d.filesusr.com/ugd/184831_e024f4f7ea8446a7853a67ddc4fc1ddb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce1cb9c4-12ad-432d-8707-b2e5f18582b5/mcgraw_hill_math_grade_5_workbook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c8d2717-8677-49ce-bddd-0e3f8356db6f/excel_2016_shortcuts_not_working.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e446.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE446 5744 bytes
SHA-256: fa36938df45edc3bf1584cd56354613e837e69217c2e62f9ed1cf337427366e9

Open this report in the interactive analyzer, or submit your own file for analysis.