Malicious PDF — malware analysis report

Static analysis result for SHA-256 151ad9b3482bf809…

MALICIOUS

PDF

80.1 KB Created: 2021-05-02 07:11:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 788bdb4bfeb046d583d287768a3029cb SHA-1: d523e993086f4dd74b911d19b33d463c720d87d2 SHA-256: 151ad9b3482bf80901b3033a931683ae7588e0b60194d92c9843c60319fd875a
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=sherlock+holmes+book+read+online PDF link annotation
    • http://xirapanagix.getenjoyment.net/jumuwagu.pdfIn PDF document text
    • http://kobivoweder.mypressonline.com/fair_housing_act_of_1988.pdfIn PDF document text
    • https://bululuxoragoxoj.weebly.com/uploads/1/3/0/9/130969030/6386802.pdfIn PDF document text
    • http://fobativ.mywebcommunity.org/75997259621.pdfIn PDF document text
    • https://nupewaxupojiga.weebly.com/uploads/1/3/4/0/134042887/jiloduxokupimat.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://7f1158f2-e44e-4cac-991a-806210d1dc3e.filesusr.com/ugd/e4a8e1_5684d0b1ef1943a392b8227b1cfaa6e7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/98ef069e-60d3-4a55-99e7-10fb29aa5ab4/28401415027.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d958f33-d580-4240-86d7-20af3c28b940/curse_of_strahd_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c83da4ec-e1a1-4484-83ee-fd3f7d3c405a/fefivitu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a6af39c-bc15-4bdc-af8c-02ab704a6444/tiwinuxizigutipudunev.pdfIn PDF document text
    • https://dda5c79a-a75d-44d9-a006-48dec3bfe172.filesusr.com/ugd/115d6e_b922a3443323499aa76e2c47a72a3e4e.pdf?index=trueIn PDF document text
    • http://bototiluwoge.atwebpages.com/fungsi_bilangan_kompleks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87ca5ac0-4011-4618-b56c-072d4f5a98c3/72760377388.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93ba26c2-4046-473f-a8d9-a559377ab5d1/lotukeg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c9e96ca-d153-4ef8-9375-294eed8513a6/vifogafofimemo.pdfIn PDF document text
    • http://nizowozutagele.atwebpages.com/science_of_mind_core_principles.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0548f51-27ba-4eeb-a402-3babfe215227/what_are_the_rules_of_cricket_darts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/378c1983-2277-4e10-b230-2f4f5e06f667/55815224878.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbe5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBE5 5488 bytes
SHA-256: a7fe7c6e96813c743284fcc1aca9d25eb71bc481d5d8517bd1b5faf6402b53f3
font_01_sfnt_off00010e5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E5A 10904 bytes
SHA-256: 5e68f4c3f23abd77e63e32f93de1273da343681aa76c05c2e270cd99be6f619e

Open this report in the interactive analyzer, or submit your own file for analysis.