Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e9881ecdada8bf2…

MALICIOUS

PDF

106.0 KB Created: 2021-03-16 03:20:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 9fc724fec21ac5ee0c738c1a342fd246 SHA-1: c60732a3b6ac4cb6d5e435fc1d6bc1d58c11c3e2 SHA-256: 1e9881ecdada8bf27fe9eba0b818c0494d654842d74d8c6dd82ad2b1958d55e5
174 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains multiple suspicious links to domains such as http://com-login8.xyz/wireredipl4pdw.pdf and http://wedipum.mygamesonline.org/thinking_fast_and_slow_audiobook.pdf, some of which are presented as invisible links or part of a link farm. The presence of a 'download button' heuristic further supports the lure-based attack pattern. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=weed+firm+4+apk+download PDF link annotation
    • http://wedipum.mygamesonline.org/thinking_fast_and_slow_audiobook.pdfIn PDF document text
    • http://flylovel.com/servicenow_role_to_view_reports9mapn.pdfIn PDF document text
    • http://vbnmcxz.xyz/naxizimuluzewqyk2.pdfIn PDF document text
    • http://com-login8.xyz/wireredipl4pdw.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425726/normal_5ff1de7ba0b61.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393033/normal_6044221d75092.pdfIn PDF document text
    • http://swiss-gear.shop/lonely_planet_japan_2019up504.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495391/normal_5fc6a479424ea.pdfIn PDF document text
    • http://policyhelpcenter.com/causal_comparative_research_design_with_authorh9d80.pdfIn PDF document text
    • http://pearhaidhr.fun/jemadabur5bjth.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481527/normal_60184242ad3bd.pdfIn PDF document text
    • http://zavodtriumf.com/acko_bike_insurance7e5vq.pdfIn PDF document text
    • http://keluzizizeroki.getenjoyment.net/basic_cricket_rules.pdfIn PDF document text
    • http://usacreditscore.info/tanibenomevadememokagesavdjtik.pdfIn PDF document text
    • http://menbp.online/228357350230xn3h.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3b41757-f75f-427f-afc6-71e66f73f23f/pawesupuluvil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3dc2b561-5d36-4948-8024-c5d2b099c78b/navitimireb.pdfIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/55797942993.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c8587b2-8e67-4746-bf69-ef5d8f37585d/7.3_powerstroke_engine_layout.pdfIn PDF document text
    • https://s3.amazonaws.com/wuxupewu/ditunibedenaxa.pdfIn PDF document text
    • https://s3.amazonaws.com/gofilafixu/33732229808.pdfIn PDF document text
    • http://vobozezojip.onlinewebshop.net/software_engineering_architecture_driven_software_development.pdfIn PDF document text
    • http://bavatesivo.myartsonline.com/liwine.pdfIn PDF document text
    • https://s3.amazonaws.com/fosalizuzu/computer_hardware_lincoln_ne.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014c5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C5C 5196 bytes
SHA-256: 293e51990feab1250bdc778b288640c7837de29a114c1dcb0715b353ea5c4be3
font_01_sfnt_off00015e91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E91 5268 bytes
SHA-256: 656b97c0314fe432742578ae855df864c162067f7c1a47efde40d6f7e79a86bf
font_02_sfnt_off00017085.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17085 12596 bytes
SHA-256: f9151bd6b2dcbef9ad57448ae6c8e3ac7e8d7293fee88adb4ca77cd8a188aa3b

Open this report in the interactive analyzer, or submit your own file for analysis.