Malicious PDF — malware analysis report

Static analysis result for SHA-256 26a75314073ba168…

MALICIOUS

PDF

66.8 KB Created: 2021-03-08 15:26:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 7ca7a9c385eeea9a4aa53ce844895b4c SHA-1: 23dc62730c6c0169046bb5f611325aef0a7f4ae8 SHA-256: 26a75314073ba16892a1a2f63c40730283d37c3f17cda6da7bc7f1ae27bc6b1e
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8526

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=designing+data+intensive+applications+kleppmann+pdf+download PDF link annotation
    • https://cdn.sqhk.co/jeforije/fLmTq6B/jubizanopixopiw.pdfIn PDF document text
    • https://cdn.sqhk.co/noruwotil/Rkifih0/vuvepivozowodate.pdfIn PDF document text
    • http://bejavivamiji.22web.org/linden_clocks_made_in_japan.pdfIn PDF document text
    • https://cdn.sqhk.co/wugeguxu/jgHhhfH/idle_world_cheats.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455914/normal_603d0ace36a1c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403429/normal_5ff0076cb880a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460981/normal_5fec15cf15b43.pdfIn PDF document text
    • http://lefavapexusa.iblogger.org/capsim_capstone_team_member_guide.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408002/normal_600e3fac5c7e6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fitewuvo.rf.gd/atwood_water_heater_troubleshooting.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c392b28f-ba86-4d66-812a-23ceb5a0b430/gonuzem.pdfIn PDF document text
    • http://vomemozasaz.rf.gd/rosivuvuserijipaku.pdfIn PDF document text
    • https://s3.amazonaws.com/sorogamat/apple_app_store_apk_ios.pdfIn PDF document text
    • https://s3.amazonaws.com/juwofuxufijup/wedorezesiwajudivemini.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3239a49-771c-480c-8faa-915e7f98ec95/filowapetimodajowofe.pdfIn PDF document text
    • http://nixevafuzija.epizy.com/46191124613.pdfIn PDF document text
    • http://mezomiwewelebe.epizy.com/colour_mixing_wheel_template.pdfIn PDF document text
    • http://tofezaniv.rf.gd/hp_z420_release_date.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/vujuvibipinevi.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5A1 5596 bytes
SHA-256: d67308ff1349541adb5736b63f892ad1585c74dbe73f93a1ccd96a580f4e2ff0

Open this report in the interactive analyzer, or submit your own file for analysis.