Malicious PDF — malware analysis report

Static analysis result for SHA-256 297bf1de9b94debc…

MALICIOUS

PDF

73.4 KB Created: 2021-04-15 09:02:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: abea1a2f0e46bc22d2823ed62d3b4330 SHA-1: c1e7f87a42a17baf3c7f17905414ad2c45f988fe SHA-256: 297bf1de9b94debc9527e98084b6e13f908b7e0247287aebc28945fa69f9791d
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=coleman+3000w+generator PDF link annotation
    • http://mapizemi.22web.org/capablanca_chess_fundamentals.pdfIn PDF document text
    • http://cloudplay.xyz/52425005109pij8p.pdfIn PDF document text
    • http://laithub.pro/97147433953vumdz.pdfIn PDF document text
    • http://braco.ru/65977014841shmwm.pdfIn PDF document text
    • http://dimax-matrasy.ru/rafejuse80j35.pdfIn PDF document text
    • http://sberbank.link/rebivelumefiyc96g.pdfIn PDF document text
    • http://ogranicbio.space/msi_790fx-gd70_error_codesql0ig.pdfIn PDF document text
    • http://driveformclanemilwaukee.com/3718820635xquiy.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c39150a7-3fae-4800-86a9-d818c2226522/89235981829.pdfIn PDF document text
    • http://xotibebigugipan.epizy.com/96017960180.pdfIn PDF document text
    • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_f02d69c7185f4a02a2daaee1bcd58405.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tuzamada/alderbrook_school_uniform.pdfIn PDF document text
    • https://51bf459c-6b46-41b0-863f-532cf8a77e0d.filesusr.com/ugd/2eedf1_c048567d58154224aa96701e7a06e473.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/05f6db43-e4a0-4f0b-ace6-762e987cd675/nipuxupaputepuwozof.pdfIn PDF document text
    • http://kulikonabe.rf.gd/lehninger_biochemistry_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/juzewojavomofew/ejercicios_de_conjugacion_de_verbos_regulares_en_espaol.pdfIn PDF document text
    • http://mubapumasas.epizy.com/26108841951.pdfIn PDF document text
    • https://b564fea6-732e-489f-a029-a72dc6590de2.filesusr.com/ugd/6a4619_52136a705b2d48aabdf6a63584515602.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tonisefoteka/reset_iomega_storcenter_ix2_factory_default.pdfIn PDF document text
    • https://6b137298-3864-41c5-aaa3-11744000c3c2.filesusr.com/ugd/b916f4_899f7789d4424d249c093ee5b53710c5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2D9 5128 bytes
SHA-256: 71c01305d7dc07930e559a7c09043cf56db6bbdffc03361236163d13210f22c1
font_01_sfnt_off0000f43f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF43F 10692 bytes
SHA-256: 49cad0ff65ee598aa8912d517b7090e40c0a9fc8c73f969c1ef2bc16ac8c556e

Open this report in the interactive analyzer, or submit your own file for analysis.