Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e45e41ff21579ff…

MALICIOUS

PDF

75.0 KB Created: 2021-03-15 07:12:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 8c9dc42dfec69f87e7dcf91cce4874e5 SHA-1: d4665ee0bcbc94d116472aab7f4bc11f27139760 SHA-256: 2e45e41ff21579ff582751651ae46f0e90352da59f30405a26b2716cf2bc8c2a
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8000

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=cara+convert+pdf+ke+word+offline+android PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4411228/normal_5ff293871b63d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413712/normal_601dad91212a9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473926/normal_5fc8a393c8173.pdfIn PDF document text
    • http://tesevamomavuruf.22web.org/20700932089.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467277/normal_5ffb3effce60d.pdfIn PDF document text
    • http://modugub.iblogger.org/innova_3160b_firmware_update.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461761/normal_6033a3b8bb700.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bojafazes/child_play_movie_in_tamil_free.pdfIn PDF document text
    • http://gedamodeges.epizy.com/year_end_bonus_guidelines_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/farefasejikap/budget_2019_income_tax.pdfIn PDF document text
    • https://s3.amazonaws.com/kubafezin/punctuation_worksheets_free_printable.pdfIn PDF document text
    • https://s3.amazonaws.com/banula/effects_of_migration_in_nigeria.pdfIn PDF document text
    • https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_10ae5a4dc5bc4fffbe2a664b9afff209.pdf?index=trueIn PDF document text
    • http://zulidemuw.epizy.com/frigidaire_professional_refrigerator_parts_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/nevowimo/xikolikuf.pdfIn PDF document text
    • https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_97359a1a3662404a90e5e63809b7981c.pdf?index=trueIn PDF document text
    • https://153f2bed-3501-4ec5-9468-ed1987511f6d.filesusr.com/ugd/f67134_88f41af211fb41a5aa48d7c716f83182.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/faxaxos/23776527786.pdfIn PDF document text
    • http://fudewalazakukug.epizy.com/bootstrap_template_simple_portfolio.pdfIn PDF document text
    • https://9a1eab6f-da2d-4a41-99bb-18a59f11b130.filesusr.com/ugd/c2b690_2ad56dc843874492acc3158871cb8ff7.pdf?index=trueIn PDF document text
    • https://3caa4030-7dd6-4be4-8a8a-e1981c45b3cd.filesusr.com/ugd/704988_adaa690080774fc5b679456474df6191.pdf?index=trueIn PDF document text
    • https://94cb5446-44f7-499c-8ddd-8d9df3a2db3d.filesusr.com/ugd/9b9c26_610058f2475a410b9916441c193d3012.pdf?index=trueIn PDF document text
    • https://93bb5028-8b17-4c47-8ab9-f46a024b0e86.filesusr.com/ugd/041612_2957ef2c91ee43b4a039146d16f2a5cf.pdf?index=trueIn PDF document text
    • https://58fabbca-0322-4868-a582-948aa19840f9.filesusr.com/ugd/93748c_57dc9ed78ef34aac8a0f924fc0cba090.pdf?index=trueIn PDF document text
    • https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_8b2f8be9040b45e1b60cc4b71713c6bf.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB2C 5092 bytes
SHA-256: 958710721c8ae9231cfdb3d8de999fbb7207ec6c860d2e507c02fa958a1c4892
font_01_sfnt_off00010ca8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CA8 10844 bytes
SHA-256: 61f85dfa11e8e32a119daad84e1d8095288698b12a625ad1e8bdf67a14787696

Open this report in the interactive analyzer, or submit your own file for analysis.