Malicious PDF — malware analysis report

Static analysis result for SHA-256 190eaea12b92c835…

MALICIOUS

PDF

77.6 KB Created: 2021-04-04 17:32:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 863ad98e7d1101646cfe6f041812dd04 SHA-1: 96ef18a679255b7b2c1cc4d49658ca1d0429c3ab SHA-256: 190eaea12b92c835258041d4a11345f68fc42bee20c57e0366d4a252b1df395c
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=la+la+land+original+motion+picture+score+vinyl PDF link annotation
    • https://cdn.sqhk.co/kozosorole/aXjWicq/xusexodojaru.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367273/normal_6031d7ac53664.pdfIn PDF document text
    • http://puzotupisebi.66ghz.com/vivamekiwirotefasolubese.pdfIn PDF document text
    • http://differencecheats.net/84076584708rlgdd.pdfIn PDF document text
    • http://eushopvmn.site/28439109465ngnuy.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393883/normal_5fe2792453b86.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483623/normal_6065c18f559b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369783/normal_604b3b0752c29.pdfIn PDF document text
    • https://cdn.sqhk.co/pevelefotuve/aa2hbic/nuxoxusuli.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://segixiw.epizy.com/verona_nj_police_reports.pdfIn PDF document text
    • http://milisepidug.rf.gd/ascites_guidelines_nice.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf10a6c2-03a5-43d8-b677-10b462e07e43/pope_leo_xiii_rerum_novarum_summary_paragraph_by_paragraph.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b99dcf3-9623-48cf-b4c2-73aaf425a53e/is_captain_underpants_a_banned_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f6719a8-61d7-4f9a-89f5-0db0a275226b/sound_blaster_z_outputs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2dccebb3-85e7-4d27-9592-9bf9fe7fa277/vurutiwa.pdfIn PDF document text
    • http://dasamixatile.epizy.com/rutitosexezutomewulowerun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/541244ef-3090-4cfe-bd32-bfcdb25cc275/residential_lease_agreement_california_in_spanish.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6fd6710-1cb9-45e1-b714-bf2c57ff8e47/biblical_hebrew_vocabulary_list.pdfIn PDF document text
    • http://wapanemajefo.rf.gd/vapobukazojarex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/246e6dd6-d88f-410d-a1c3-07d76d0c0f48/which_equation_represents_the_standard_enthalpy_change_of_formation_of_ethanol_c2h5oh.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/754d399b-699c-42cd-89fc-ccb187b36f92/dell_optiplex_9020_lan_driver_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6583a10-30fb-4037-8c6d-605684ca41be/70346629991.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d77e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD77E 6696 bytes
SHA-256: 8e890696c3f4cbd3feb679602d965b10c1e8841401fc378c30c1b4ed8096bc65
font_01_sfnt_off0000ee25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE25 5496 bytes
SHA-256: 6992890b0499767e344b97364812024912ead46ea986284a2482df2ad8396e1b
font_02_sfnt_off000100d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100D0 11080 bytes
SHA-256: db2dd71caa7de1a0ae4e9cba7ee974d48f8165b16a8a316f3bc4546160613c78

Open this report in the interactive analyzer, or submit your own file for analysis.