Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e7549017d9c20eb…

MALICIOUS

PDF

153.1 KB Created: 2021-04-01 09:27:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: be363210cb91cf26a6d107d104462f4a SHA-1: 99034fd45f025e2b05eb21d96b7cc7088373b8c9 SHA-256: 2e7549017d9c20ebd1244ff1a54a3cea8f27dfa52f0f8e3e376e1987c1b7e119
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8279

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=mortal+instruments+cast+luke PDF link annotation
    • http://golden-bridge.pro/is_there_a_working_ps_vita_emulatorfce9f.pdfIn PDF document text
    • https://cdn.sqhk.co/muvotugi/jagfih7/best_nail_polish_brands_for_water_marbling.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367624/normal_5febf1c298e1a.pdfIn PDF document text
    • https://cdn.sqhk.co/lamidipeke/gjr2g1P/asian_car_simulator_2020_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/nosamese/BGQThd2/super_modpack_bombsquad.pdfIn PDF document text
    • http://pirewarekow.mywebcommunity.org/features_of_human_resource_development.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371244/normal_605c17a94c9dd.pdfIn PDF document text
    • http://microdigitalmeter.xyz/baal_veer_episode_963g23ja.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459776/normal_605186708ffd5.pdfIn PDF document text
    • http://tersq.space/99433851553wd4m5.pdfIn PDF document text
    • http://puvepum.getenjoyment.net/triptico_de_alcoholismo_y_drogadiccion.pdfIn PDF document text
    • http://srakan.space/27683687416jhaeh.pdfIn PDF document text
    • http://imkl-checker.com/72300285421ofsz1.pdfIn PDF document text
    • https://cdn.sqhk.co/fefowofuk/Kgdgjgj/ice_cream_roll_machine_for_sale_uk.pdfIn PDF document text
    • http://servempieza.site/what_is_special_personal_auto_policyudlme.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://bepolujogox.atwebpages.com/xufubon.pdfIn PDF document text
    • https://ff536187-e25a-4bd2-965b-ff1113cf40b0.filesusr.com/ugd/bfcccc_9796b1f3f6cd4fc1a41d63231205638d.pdf?index=trueIn PDF document text
    • https://52a72965-a6d2-471e-b66a-59a59a4d663b.filesusr.com/ugd/e643da_5024b4d6ab724bd0a6123874a7e7d6ae.pdf?index=trueIn PDF document text
    • https://bef89f6e-6323-4b84-ad9d-a44490bfcc4f.filesusr.com/ugd/96768c_66395186b482423d8d1081904b314065.pdf?index=trueIn PDF document text
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_5d7706ba5ba948c396951b6c3f82de1b.pdf?index=trueIn PDF document text
    • https://45ae50e1-98a8-4501-9ad6-fc0df438eb43.filesusr.com/ugd/b16523_ce6ed8e285c34db494eb1f5b87a25e26.pdf?index=trueIn PDF document text
    • http://bitines.myartsonline.com/how_to_estimate_road_construction_costs.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002208d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2208D 4896 bytes
SHA-256: 9912027d6e01328eacd81ba84a3b0d17f87ce54147d9cd0a86606c94f2b7fbb5
font_01_sfnt_off0002311b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2311B 12100 bytes
SHA-256: f5cfcaa92ec3d56c239ea6df68202b17e19d489dc82d435f30dab0aa40fe0057
font_02_sfnt_off0002599c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2599C 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.