Malicious PDF — malware analysis report

Static analysis result for SHA-256 15e793a10e2a5f90…

MALICIOUS

PDF

72.2 KB Created: 2021-03-12 11:56:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: cf3bf11883f01f250f7689aaa7a3d075 SHA-1: fc1749514e281e934e4dd4292277da98272713fb SHA-256: 15e793a10e2a5f904425a32996bdd9c56fe2673db314f975d852c17ee004fc5e
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8641

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=nigerian+army+ranks+and+symbol+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4418180/normal_5fccf0ab427ff.pdfIn PDF document text
    • https://cdn.sqhk.co/gepumenujeme/eiYngcR/medieval_wars_free_strategy_tactics_mod_apk.pdfIn PDF document text
    • http://jedilinosur.mywebcommunity.org/mutofetukazot.pdfIn PDF document text
    • http://kvyovk.xyz/what_is_net_national_income70irj.pdfIn PDF document text
    • https://wobelafesuta.weebly.com/uploads/1/3/4/7/134767333/5cf6ac1d88e.pdfIn PDF document text
    • http://dorulezebum.sportsontheweb.net/its_never_easy_to_walk_away_let_him_go.pdfIn PDF document text
    • https://cdn.sqhk.co/fusojafiza/eu1giig/76536365675.pdfIn PDF document text
    • https://cdn.sqhk.co/xaxovowupofa/jiWghCT/amazon_general_manager_assistant_salary_uk.pdfIn PDF document text
    • http://reduslim-italiaufficiale.site/manualidades_navideas_con_tubos_de_papel_higienico0rhoj.pdfIn PDF document text
    • https://cdn.sqhk.co/fimegasaz/jfjggeg/streamlabs_chatbot_timers.pdfIn PDF document text
    • http://stopro.store/160974657906vlo3.pdfIn PDF document text
    • http://pidikugojan.22web.org/carta_de_verificacion_de_empleo_ejemplo.pdfIn PDF document text
    • https://pesasujax.weebly.com/uploads/1/3/4/8/134882000/fisifemiwabufuruk.pdfIn PDF document text
    • https://galixasuja.weebly.com/uploads/1/3/4/5/134518214/jabarijarekolodored.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402289/normal_5fdf34480ff93.pdfIn PDF document text
    • http://xenogejewaruvi.22web.org/flight_of_the_bumblebee_sheet_music.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476758/normal_6021f8be0e98b.pdfIn PDF document text
    • https://cdn.sqhk.co/wituruxa/fmghdsU/ghost_rider_2019_issue_1.pdfIn PDF document text
    • https://fuburufogukedez.weebly.com/uploads/1/3/0/7/130776130/gagagisumojadek.pdfIn PDF document text
    • http://ionatr.space/zigejoxewinoromekiwoeenjl.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://jilovin.epizy.com/nuwim.pdfIn PDF document text
    • http://rulosovudaxuf.rf.gd/resumen_historia_de_una_escalera_selectividad.pdfIn PDF document text
    • http://xiwozoget.atwebpages.com/15863729515.pdfIn PDF document text
    • http://xaguxebijop.epizy.com/doan_tuyet_sheet_music.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7A3 5344 bytes
SHA-256: ddb30d06d3774cb6d931421a72a952d197f61ad46610cf01a7478a438e5bb089
font_01_sfnt_off0000f9b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9B0 10244 bytes
SHA-256: f78adde6e73796517cfc215d6c4f09175c52252555170e805d7dc69bbc43ca0b

Open this report in the interactive analyzer, or submit your own file for analysis.