Malicious PDF — malware analysis report

Static analysis result for SHA-256 174393eb3756457f…

MALICIOUS

PDF

75.1 KB Created: 2021-04-30 19:05:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: fe28c963daa7f287b4a51cadb3a27e91 SHA-1: cd56101e4ba9e2a1e1ce55ca8b524c0b6ade3e3b SHA-256: 174393eb3756457f355740cb2b193f1a5bc26dfeb161b69dc042320ca78f1644
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to SEO redirectors and link farms, indicating a phishing or malware distribution attempt. The presence of a critical heuristic for PDF SEO link farm and a high heuristic for PDF SEO redirector link, along with ClamAV detection as Pdf.Phishing.Trojan, strongly suggests malicious intent. The primary IOCs are the redirector URL and a linked PDF from a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=grammaire+expliqu%25C3%25A9e+du+fran%25C3%25A7ais+exercices+pdf PDF link annotation
    • https://fidimamafiw.weebly.com/uploads/1/3/4/6/134624465/6058681.pdfIn PDF document text
    • http://montana-media.com/how_do_you_book_the_cinderella_castle_suitetihvx.pdfIn PDF document text
    • http://wordwild-store.com/difedobonawugulowilg8wq.pdfIn PDF document text
    • http://naykaryadom.fun/72727201760u8yv4.pdfIn PDF document text
    • http://lofitner.buzz/66701116127rt81q.pdfIn PDF document text
    • http://remont-kholodilnikov.website/39117092471vwh5u.pdfIn PDF document text
    • https://duzopuxezofuj.weebly.com/uploads/1/3/1/3/131382696/9709c5a4dbfd0.pdfIn PDF document text
    • http://lightly.store/bemuvotexowepisurebup9wsi.pdfIn PDF document text
    • http://specrazreshenie.com/mokidazoledof5pz1.pdfIn PDF document text
    • http://stnold.com/catalogo_avon_campaa_15_2020_argentina3668e.pdfIn PDF document text
    • https://volinamonapefez.weebly.com/uploads/1/3/4/4/134494747/3099df6ac6.pdfIn PDF document text
    • https://buwolerujagelav.weebly.com/uploads/1/3/4/5/134580081/lidokur-taniz-tokavefidar.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/8c8d6342-7238-4dbc-af86-a03fb7a13ac4/dujopulujorapal.pdfIn PDF document text
    • https://s3.amazonaws.com/dosipive/leadership_coaching_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1feeacb3-12e0-4f27-9692-a545d3d88319/nasej.pdfIn PDF document text
    • https://s3.amazonaws.com/vuzotisenixava/how_many_carbs_are_in_a_chicken_taco_salad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/332a7ceb-1c19-4456-9dda-958f9e1e08aa/does_uppababy_ever_go_on_sale.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/mathematical_form_of_heisenberg_uncertainty_principle.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06754d31-82f5-4910-a8f1-d53810fe1d57/56654213171.pdfIn PDF document text
    • https://s3.amazonaws.com/rivazixexuguri/mifegu.pdfIn PDF document text
    • https://s3.amazonaws.com/tetofamuxulil/how_to_study_life_sciences_grade_12.pdfIn PDF document text
    • https://s3.amazonaws.com/gedimuta/dugilobuvevomupofawife.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ca5a12f-6bae-4c79-9138-550a29b6746f/the_power_of_one_movie_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/zijivevip/raiders_bears_injury_report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d67f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD67F 5544 bytes
SHA-256: d81cc5874e92609453e48c5d6d1be69c2ad29b9cb78fc73c8d93695993bc1a4b
font_01_sfnt_off0000e8b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8B4 11880 bytes
SHA-256: d655b86e497a399a61741f4ba9775e7e652c3896d914a02ad959023edb99bdd9
font_02_sfnt_off00010dc3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DC3 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.