Malicious PDF — malware analysis report

Static analysis result for SHA-256 152d89fd7141f755…

MALICIOUS

PDF

76.9 KB Created: 2021-03-20 13:16:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 2b4d20ff40301ad0193b1e6963423401 SHA-1: 4f0d60c2bedaa3cf3963487734c550c2252b6caf SHA-256: 152d89fd7141f7555ce5b992a683aeb7443953e1e22aad7d9246a9d0800f5964
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO spam operation. The document body, though heavily obfuscated, appears to reference a sewing machine manual, likely as a lure to direct users to the malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=tailor+sewing+machine+834+manual PDF link annotation
    • https://cdn.sqhk.co/berovanova/Thjcjc9/84448216016.pdfIn PDF document text
    • https://cdn.sqhk.co/nivatasob/cVbB5PM/54895974204.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366000/normal_5ff1463734d9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471083/normal_60286aae9f251.pdfIn PDF document text
    • https://zuxosudeti.weebly.com/uploads/1/3/4/3/134359900/88066fbfa99f543.pdfIn PDF document text
    • https://ragurukenawuxif.weebly.com/uploads/1/3/4/6/134667210/11ff0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470035/normal_5ffdda3b95194.pdfIn PDF document text
    • https://cdn.sqhk.co/lagusive/hQbheje/chatous_token_hack_apk.pdfIn PDF document text
    • https://belawutuvuzepim.weebly.com/uploads/1/3/4/6/134605506/7fcc12bc89d.pdfIn PDF document text
    • https://cdn.sqhk.co/xamitarerivu/LKijR5y/45334061698.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496381/normal_5fd6ef31839c7.pdfIn PDF document text
    • https://vakogiguwowokel.weebly.com/uploads/1/3/0/7/130775334/duxapukegedeg-puput.pdfIn PDF document text
    • https://zaxanedipujez.weebly.com/uploads/1/3/4/5/134582154/pufidakibejagow-jifiboxuv-lidebenodumuz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486965/normal_60318472c7d2d.pdfIn PDF document text
    • https://cdn.sqhk.co/nugizape/SickUif/15300579252.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://0ed7c29b-d5f2-4290-8b47-add6aa38300d.filesusr.com/ugd/32a223_9888f3e5ec7c48c6adb6ffef4c954f76.pdf?index=trueIn PDF document text
    • https://35479656-6a94-44d6-ac55-da507c14a2ae.filesusr.com/ugd/d68318_6d4639f6c0b34ba2a258d36337186086.pdf?index=trueIn PDF document text
    • https://bbaef297-c986-4b42-acb3-0fd65605e280.filesusr.com/ugd/e9fc71_62de86d677d94eef916d91de65c0a868.pdf?index=trueIn PDF document text
    • https://c0b8f06b-4e98-4d3d-89ef-2f08caba629a.filesusr.com/ugd/0c8cc8_1744e6e3f3c745598942f027ed72c2e9.pdf?index=trueIn PDF document text
    • https://9d349da1-218b-4b59-9e37-2a90cab56d40.filesusr.com/ugd/de9003_8ad9529b9b6b480aad4ee7380fe27e8c.pdf?index=trueIn PDF document text
    • https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_4397ed712ee245a3b2fc808266d76ce1.pdf?index=trueIn PDF document text
    • https://5057b38b-f250-4925-a5fd-2dbc054a2c1f.filesusr.com/ugd/25ee37_40b6ed7fcc8f48aaace68845508b32d7.pdf?index=trueIn PDF document text
    • https://737c154f-ca75-4484-807d-9d5c19d76377.filesusr.com/ugd/7e84b7_2333a742f7734e5cb4e721aa1b0c3e05.pdf?index=trueIn PDF document text
    • https://0c241ebc-151b-48bf-a4db-a9f2ee65d67b.filesusr.com/ugd/c17081_223b14e4d828490b8f885ef3692ffa3e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED97 5700 bytes
SHA-256: 27509a39decd1038175f265ca8cbb8939b6b261001438a5e4989980c68837aa8
font_01_sfnt_off000100ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100ED 10484 bytes
SHA-256: 8b54fae1232a839cedcae256278b93077600513d8f21ea0008db39a3211973fe

Open this report in the interactive analyzer, or submit your own file for analysis.