Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cb63c4d99fc2ea3…

MALICIOUS

PDF

63.5 KB Created: 2021-03-12 16:22:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: af6ba715ddca5b48d96477ba495a3a10 SHA-1: 963ef96db2afd63847aa83949e0605ea579bd89a SHA-256: 2cb63c4d99fc2ea3f3ed552569c31053b8fdc42dd182ccfe706de5de2da71050
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9635

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=what+is+the+role+of+a+trustee+in+a+church PDF link annotation
    • http://kiritisivasol.mywebcommunity.org/musica_cristiana_indigena_de_guatemala.pdfIn PDF document text
    • http://ruvinowuge.scienceontheweb.net/nolusepuzow.pdfIn PDF document text
    • http://idealslim-italiaofficial.site/21577504125lwapa.pdfIn PDF document text
    • http://dufigep.scienceontheweb.net/sivalepufunudiraga.pdfIn PDF document text
    • https://cdn.sqhk.co/nufesewepi/knQXVij/juwevuvofewij.pdfIn PDF document text
    • http://chatik85939775.fun/pozabibuxewavuw5w21x.pdfIn PDF document text
    • https://cdn.sqhk.co/vumulevezuf/6gftKwF/bedford_reader.pdfIn PDF document text
    • http://grizhoff.ru/9._snf_fizik_konu_anlatm_kitap_indirt1t8c.pdfIn PDF document text
    • http://biomanix.best/what_happens_at_the_end_of_doctor_sleep_bookmki0t.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://20128683-61eb-4207-b985-d468b1a81fea.filesusr.com/ugd/0049ca_c0504caf99bb42fa969228d6a3652c49.pdf?index=trueIn PDF document text
    • http://biwosagamivi.myartsonline.com/21921412106.pdfIn PDF document text
    • https://e6a48395-9ebc-465e-8505-c4b20d7b8e72.filesusr.com/ugd/81e12b_5568350cc8814e22a338dde26b151368.pdf?index=trueIn PDF document text
    • https://e824aeac-d22a-4b45-bb3c-17051d6ee04f.filesusr.com/ugd/de60da_e938cf84385641ebb58ddd1a824a4305.pdf?index=trueIn PDF document text
    • https://2a403a33-5f6e-4534-96f9-742aa7325afc.filesusr.com/ugd/d2da83_d7372c250e424843a8ebf15c90ecbbd0.pdf?index=trueIn PDF document text
    • http://terumalok.atwebpages.com/8040963439.pdfIn PDF document text
    • https://s3.amazonaws.com/lorugipopuxe/mazaziwosixojakukenukuw.pdfIn PDF document text
    • https://s3.amazonaws.com/kefodek/architecture_colleges_in_tamilnadu.pdfIn PDF document text
    • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_b7a5af64aa5c464899951a52dc3ee341.pdf?index=trueIn PDF document text
    • https://807eaacf-9fb6-4e16-bcb8-061395d1d132.filesusr.com/ugd/a3ef2e_cb1f4561089b493cbf25c29cef8f617c.pdf?index=trueIn PDF document text
    • https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_ce409685984c497f8c92c66e82f38b04.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jifedefujodu/us_army_field_artillery_school_lawton_ok_73503.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0C6 4980 bytes
SHA-256: d7e1009f52106800b6f260a53078b7f13d6c615d7a47d2ec0d595a62e38ade31

Open this report in the interactive analyzer, or submit your own file for analysis.