Malicious PDF — malware analysis report

Static analysis result for SHA-256 175e844fadec2660…

MALICIOUS

PDF

83.6 KB Created: 2021-03-22 13:43:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 51217151b0c1c2c8bbed235d9632c23f SHA-1: 53105bd3642eb53eabcccd51cd9ee54a3438188b SHA-256: 175e844fadec26608b0cd4154a15e78600113b93bcd8ea214084b93c01a91875
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, with one suspicious URL pointing to 'xezojetit.ru', suggesting a phishing or SEO spam campaign. The PDF structure itself is indicative of a link farm, likely designed to redirect users to malicious sites or for SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=abhinetri+2+video+songs++telugu PDF link annotation
    • https://moxuwurenawa.weebly.com/uploads/1/3/0/8/130874588/3616671.pdfIn PDF document text
    • https://tenivutod.weebly.com/uploads/1/3/1/0/131070705/c23ada5ddce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459916/normal_603674d0b80f6.pdfIn PDF document text
    • https://taxirexojonub.weebly.com/uploads/1/3/4/7/134767272/zenavotujejosir.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488323/normal_5fee444ecc793.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474169/normal_602fad4e9e3a0.pdfIn PDF document text
    • https://jewupoma.weebly.com/uploads/1/3/1/4/131437657/9636023.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447663/normal_5fd67d5086063.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://8d40832c-2e2b-4284-8151-bb35a16d80ac.filesusr.com/ugd/05d014_2d4531cc81864f70b54ad000e9b0b6a9.pdf?index=trueIn PDF document text
    • https://80b2a579-f9ed-4aa0-b91a-ac3c8973c086.filesusr.com/ugd/353d00_3b06a5ae040e4b91a5e987e5b9750653.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a256eae1-e50b-4f1a-abfc-2d09ba6bd25c/my_beloved_world_chapter_summaries_sparknotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc946221-84fd-44d7-b58c-055e57e1aee5/20.6.18_of_chapter_4_of_the_medicare_claims_processing_manual.pdfIn PDF document text
    • https://88966db1-4a83-4446-b941-f65022a6235f.filesusr.com/ugd/928e0f_4da77970ca8e4aed89361f517e9dbafd.pdf?index=trueIn PDF document text
    • https://8dea6f00-b35b-4e5f-9f5e-01d9eb130a9a.filesusr.com/ugd/6a8da5_2009e4487a27434a94ff5a7ece1b305c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cd8cb9d-2f00-4b87-b1fd-133d9d234001/8959810244.pdfIn PDF document text
    • https://6a8c3f3f-5248-4e80-80e0-4bf2c04f72bc.filesusr.com/ugd/8b2c09_ddf03fa194d3410c85be7df0dfae8609.pdf?index=trueIn PDF document text
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_2fe5c2d087c54d4eab3630706112d3f7.pdf?index=trueIn PDF document text
    • https://b7c6a474-53ed-4139-af63-4b2f501ae0e7.filesusr.com/ugd/e87294_69e7cb1bf0c2402b88034490101e15a8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/64773ae3-6651-41ac-b0ed-54376dbd6f5a/nevefijaronexiwul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2b18d40-b282-4f3b-b22b-09d8590001e6/why_is_my_samsung_phone_charger_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12126226-af9c-457f-8333-f0f96325d758/desidikajek.pdfIn PDF document text
    • https://63995da9-74be-4895-8497-a4fa53c9845d.filesusr.com/ugd/788c84_9daf534a461c4fd888d0a6030e6f9226.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA34 5080 bytes
SHA-256: f57edddf85248522c5e098f1adbbdb35bc113d2da475e95083a9dbb6f0f0091c
font_01_sfnt_off00010b72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B72 11764 bytes
SHA-256: 2cfcf51632d3e135f73bc55316ef8605852c0c6812afa952b27845c4f84c9eff
font_02_sfnt_off00013327.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13327 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.