Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c9fcea581e103e5…

MALICIOUS

PDF

81.2 KB Created: 2021-04-16 02:14:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 94408ddcbd141e40f4eb0bfedcb3b2d9 SHA-1: 107fd5fa3ac42507d4a59c81d61970c71ba9d842 SHA-256: 0c9fcea581e103e5df99f19cf9858dbd9a57b90b6ab2a0e4ab416af18f27a93e
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=hp+officejet+pro+6835+printhead+issue PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4374968/normal_5fe369bb79784.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407749/normal_603534a29686f.pdfIn PDF document text
    • http://hrushch.space/nemolidmv2oe.pdfIn PDF document text
    • http://lnstagramverificationbadge.com/class_5_english_grammar_bookw2p08.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403266/normal_60002eb48816b.pdfIn PDF document text
    • http://ryukzak.digital/98559951912u713n.pdfIn PDF document text
    • http://leaninrzpd.site/99260093093ege7u.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://18282f24-d4e3-4c19-b4d9-8e3fdaa82145.filesusr.com/ugd/df2b7b_7c7f8aae603a42458c3cb7082cb9fea8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jesidofefe/47566836206.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4428ae24-f176-4983-b211-51a0ef7936d7/duvotomizomi.pdfIn PDF document text
    • https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_1e446e38d5dd4f749e38e153d1406f1e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/miledu/antistaminico_formistin_e_sole.pdfIn PDF document text
    • https://s3.amazonaws.com/vukujidor/chaupai_sahib_path_in_punjabi.pdfIn PDF document text
    • https://s3.amazonaws.com/dazuxujepov/what_is_the_best_answer_in_interview_for_tell_me_about_yourself.pdfIn PDF document text
    • https://s3.amazonaws.com/jaxesabi/nurse_drug_guide.pdfIn PDF document text
    • https://f733e552-90a1-4d1f-83ca-a6b36afcf31c.filesusr.com/ugd/38bf1f_e043f27eda4041c4ad7a99ccb0d5c94d.pdf?index=trueIn PDF document text
    • https://3fb740b9-71d8-4183-8edb-de11b68c0a29.filesusr.com/ugd/1fbf8b_bdc82363e45848b081f65a5d95a4ece1.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed26d806-6091-48bc-af52-b33b952c3ace/vafasuxugutiguwul.pdfIn PDF document text
    • https://d4180a97-8dd0-4bf1-9e2f-d1b128d1a64d.filesusr.com/ugd/ae059d_38a04e065ce348b19c9118b5a87a824c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/time_enough_for_love_heinlein_review.pdfIn PDF document text
    • https://s3.amazonaws.com/sazomo/57536252860.pdfIn PDF document text
    • https://s3.amazonaws.com/wajufifenoxuj/lodejozulorukogusekige.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f64bb169-f4c8-492b-bfb6-84bd32909367/what_happened_to_goodbye_book.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaf9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAF9 5768 bytes
SHA-256: 65e0b7be783d65353d023611723d1134527e2c1709a59dcedf2632fc44340ebc
font_01_sfnt_off0000fe85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE85 11880 bytes
SHA-256: 1a5c8f94355bf679b85c2ca112076b1ea536c9a8efe2f72f1aee3796cd2fd550
font_02_sfnt_off00012713.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12713 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.