Malicious PDF — malware analysis report

Static analysis result for SHA-256 13f8ea6b21ec6a80…

MALICIOUS

PDF

80.5 KB Created: 2021-04-04 22:24:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 2d196fd44e9b8f1fb7f5e5fbbef06c83 SHA-1: 5826ec84a85316a21c635e42609de71691707789 SHA-256: 13f8ea6b21ec6a809ceff43ece6097c930d92e130e3e83b92476b98704898147
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=navien+nr+240+error+codes PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4370055/normal_605ca6f85c0fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451220/normal_60446c9f3043c.pdfIn PDF document text
    • https://noxagutut.weebly.com/uploads/1/3/4/4/134483949/672ad5d3565040.pdfIn PDF document text
    • https://pigixona.weebly.com/uploads/1/3/5/9/135986477/3dd03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420752/normal_60184b8092937.pdfIn PDF document text
    • https://nosovaranipad.weebly.com/uploads/1/3/4/7/134743093/ca4d4ce4fd7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416786/normal_603c46394ffb3.pdfIn PDF document text
    • https://wikusujuvi.weebly.com/uploads/1/3/1/4/131406665/tezezafara.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386829/normal_5fccb12651825.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4530868/normal_5fc80b67b6ac2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4472188/normal_5fdeb5729ea27.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481161/normal_60360ba99fe1b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://ee60c613-3dd1-430d-b711-08e3dcbf0273.filesusr.com/ugd/19ce5d_221c19828d4f4b17add593ef970d4024.pdf?index=trueIn PDF document text
    • https://7133fc40-0b9c-4701-b953-e7fafc934b44.filesusr.com/ugd/70a38d_e285e09ce5a743a8b7da6d0b84439935.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c268a86a-508a-48af-aa9a-ee99c4263e31/sex_education_3_temporada_netflix.pdfIn PDF document text
    • https://aa700e4b-9450-4a85-8b7e-8c92ffe47626.filesusr.com/ugd/de972d_e624282b69fd46d991c0b0c645f0b123.pdf?index=trueIn PDF document text
    • https://cabae152-0d18-4cc7-9545-8711a89e332e.filesusr.com/ugd/607e04_bca1cfcf7fe943a390847892b9ed3c62.pdf?index=trueIn PDF document text
    • https://178fd8f3-986e-459b-a431-83c1f58eadb8.filesusr.com/ugd/7a8e82_18b8f529ebe64deeb49c8730d57be26d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/559ef88a-88e0-4932-a371-58bed038914b/sri_lakshmi_ganapathi_stotram_in_telugu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea7ae818-6746-48fa-a977-882021372c26/talubudemawaketonofub.pdfIn PDF document text
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_3a58e8e51b194556b4e134edc069675e.pdf?index=trueIn PDF document text
    • https://435a888a-8f80-410d-aa77-77edd6e4491d.filesusr.com/ugd/51fec0_0b1849feb66f4f309182f55ed44d33c7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c1242bb-e5e2-446a-8371-d3ec09c12730/juegos_de_cine_cartoon_network.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2236531c-ec57-4ad2-8c81-8f6a23684e4c/affect_definition_mental_status_exam.pdfIn PDF document text
    • https://4228e3e8-6e56-436b-9c2a-5710a6c3a216.filesusr.com/ugd/e32dc8_5495874ad5604cd5979b2f9515f1648e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE18 5292 bytes
SHA-256: 04a0fdf2029e7bea507e200c2278149e84c58411a34484e0ed88aa49306e09a0
font_01_sfnt_off00011034.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11034 10760 bytes
SHA-256: c2140c5648eaa5655ac714d6286b6821ebc0f4f95d811ad557dd60911d0a7795

Open this report in the interactive analyzer, or submit your own file for analysis.