Malicious PDF — malware analysis report

Static analysis result for SHA-256 10b6a36aa487b3bd…

MALICIOUS

PDF

63.6 KB Created: 2021-05-14 16:12:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: bdb375686dd2b3b0bbb17614fcce67ae SHA-1: 75c421c8c8e98bf994562cfc872cecfc1af2baf4 SHA-256: 10b6a36aa487b3bd4c23541d31d5954296ab4fb17781411f561ac7aadde90e55
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7019

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=how+to+relieve+sore+breasts+when+stopping+breastfeeding PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4374835/normal_602aded1c99a7.pdfIn PDF document text
    • http://vegifeda.mypressonline.com/fevopevubiwavupo.pdfIn PDF document text
    • http://fugilugidijud.22web.org/lejoni.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427529/normal_601b8de787cd6.pdfIn PDF document text
    • http://nafewid.sportsontheweb.net/property_sale_agreement_format.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392667/normal_6064abb77916e.pdfIn PDF document text
    • http://zokoxakabu.medianewsonline.com/fejojozugit.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382003/normal_5fdc050c608c4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kujujigufa.epizy.com/despacito_line_dance_step_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3488d87d-d0e6-48a6-8830-9272d0757506/how_to_test_wheelchair_battery_charger.pdfIn PDF document text
    • http://jazopizebe.atwebpages.com/pdf_pathophysiology_of_pneumonia.pdfIn PDF document text
    • https://01ff271a-2d66-4e22-ac0f-a796646d2f56.filesusr.com/ugd/8d93e9_36a489e03fa249a895e77b55aae6d2b2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7673ed99-1be2-4538-8090-7ca08db3dee9/jazupup.pdfIn PDF document text
    • http://tasubad.rf.gd/26304292312.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5dbbeac-60a4-434c-a4c9-f10db90452eb/giremuriguji.pdfIn PDF document text
    • http://botibaxar.rf.gd/niloxizam.pdfIn PDF document text
    • https://a181bb3e-7445-4f1f-a1cf-b2fe66c13e92.filesusr.com/ugd/91ce54_a12ce0113ddc40cfa1ae72f95dc39d1f.pdf?index=trueIn PDF document text
    • http://fivajopafovile.rf.gd/fegesate.pdfIn PDF document text
    • https://80cb706b-a9cc-40e6-9cd2-ad5688d6c4a8.filesusr.com/ugd/c84a73_cf08fd5b854e4c20a2fd05a14f72c8fe.pdf?index=trueIn PDF document text
    • https://4a7d9d2b-1d67-446c-8d6d-bdd3043d1f60.filesusr.com/ugd/c3d078_231276bd28054c219f8f32139e422e01.pdf?index=trueIn PDF document text
    • https://acfcda0b-1795-4b40-aedc-9a0bc13047ce.filesusr.com/ugd/89c6ad_2753a618945a4d23bdd7eee290e9e736.pdf?index=trueIn PDF document text
    • https://28ed73df-463f-41d7-bc87-4635118fd8e0.filesusr.com/ugd/74acc8_4a458719631e48aaa798861bf4910839.pdf?index=trueIn PDF document text
    • https://72a23b54-95c1-47c0-80d6-f7b1310faeb8.filesusr.com/ugd/65b209_ae97292562c644d6a776395306bd9f75.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF4E 5556 bytes
SHA-256: d7a69b5130196c6db4183b75b7febeebe639af4c97eae9c40979a0a3ab9e26a9

Open this report in the interactive analyzer, or submit your own file for analysis.