Malicious PDF — malware analysis report

Static analysis result for SHA-256 1aa8ba9d5048712e…

MALICIOUS

PDF

72.0 KB Created: 2021-06-04 12:19:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: eff2c53b54409e95085f0206ab583c6d SHA-1: 43f357c9f4b77faca6b9ffbeaf8ea819e4d3986d SHA-256: 1aa8ba9d5048712e086fb59e07a1443581471af7855c3d56fd4e3ac9ce1ab8b5
194 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external links, many of which are part of a link farm, as indicated by the PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM heuristics. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or distributing further malware through these links. The presence of a 'download button' lure further supports a deceptive purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=verb+patterns+gerunds+and+infinitives+exercises+pdf PDF link annotation
    • https://fulapelaz.weebly.com/uploads/1/3/5/9/135970028/mirugapofa-fubasotozez-vezaro-xogemo.pdfIn PDF document text
    • https://jodaxirijiv.weebly.com/uploads/1/3/0/7/130776114/7f293a6c3da.pdfIn PDF document text
    • https://lelobetiladafan.weebly.com/uploads/1/3/4/4/134497055/2018956.pdfIn PDF document text
    • https://kepuwizetel.weebly.com/uploads/1/3/5/3/135304134/092ed9.pdfIn PDF document text
    • https://fogipomovilop.weebly.com/uploads/1/3/4/0/134018275/a161c1a921.pdfIn PDF document text
    • https://pebusopewege.weebly.com/uploads/1/3/4/7/134752512/03a0df.pdfIn PDF document text
    • https://gikemadisasov.weebly.com/uploads/1/3/4/6/134667176/pubonukalosoxe.pdfIn PDF document text
    • https://gaxizizobepebi.weebly.com/uploads/1/3/0/7/130740618/0778c719957f9.pdfIn PDF document text
    • https://zabaparadasikid.weebly.com/uploads/1/3/4/3/134317604/8591757.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f52d84db-ea12-4cb6-b4f1-e4af1b40e383/existentialismus_ist_ein_humanismus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54cf8f95-4a95-4e73-ba9b-20b9133cd210/28028270795.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbac6699-4b6e-4603-b29a-bda1a09bfd04/ipad_mini_2019_model_case.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3121078f-a8d8-4826-b39f-3a1df06c0ccf/42636967467.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25d3b8fc-45c0-45fa-a5b7-531f5e475f03/finding_dory_full_movie_hd_hindi_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0921005b-a936-4a97-91d7-eba0c9630a9d/hp_elitedesk_800_g1_tower_ram_upgrade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89b2be4e-8d7f-4371-b5a3-29b390fed54c/73092879463.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2878c3d4-d575-4971-b0ff-a7c8d5db1d39/how_do_i_fix_the_lr_code_on_my_maytag_neptune_washer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6890d64c-88ea-40ad-bbbb-5be5804be5be/harry_potter_book_1_sparknotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0757d2c0-2bf1-47db-a14b-0482ae52cab0/occupational_english_test_writing_for_doctors.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e38c3f2-fe58-489a-b0f0-0fd668959121/28973740336.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB6B 5524 bytes
SHA-256: c40d309918f16f0f65ba1eb38c3fed0d0d8e65ed2de00587395cdc088bccdbd7
font_01_sfnt_off0000ee4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE4D 10532 bytes
SHA-256: e539930edf1d9cc1ed2ddb4f2546d0e2acc05af029794ab2a8c314ea5d12cdeb

Open this report in the interactive analyzer, or submit your own file for analysis.