Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ee92ed4a8e4b38c…

MALICIOUS

PDF

89.8 KB Created: 2021-04-23 00:00:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 2bd02cc39bd39e516a5d582c9d63ccf8 SHA-1: 57b5c09336a5862f748e5c5f2d8faa26fac54d58 SHA-256: 2ee92ed4a8e4b38c6a2a4bc0427f6548cefffa7a80b1863f77c771a74cb2621e
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=can+you+view+google+earth+in+real+time PDF link annotation
    • https://xozisimoxu.weebly.com/uploads/1/3/1/1/131164350/tenulobusuwejidevun.pdfIn PDF document text
    • http://larokamexi.sportsontheweb.net/21037509044.pdfIn PDF document text
    • http://fotubobuwenapu.scienceontheweb.net/98106934721.pdfIn PDF document text
    • http://livemavuxedu.getenjoyment.net/tiloragugidasuwodaw.pdfIn PDF document text
    • https://bevarepovorumi.weebly.com/uploads/1/3/2/3/132303359/ca555381.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dezajok/lexus_rx_350_f_sport_price_in_india.pdfIn PDF document text
    • https://s3.amazonaws.com/jagux/91235130464.pdfIn PDF document text
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_20748755c723464b9c285e806eaf6e88.pdf?index=trueIn PDF document text
    • https://a22cca75-cc8f-459c-9eea-628147015b55.filesusr.com/ugd/2f8a36_ac0bb74b54ac4bfa8e70fcfac38bb1dd.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad0de270-ecc1-420b-b074-fd819fc3a072/how_to_change_mini_14_stock.pdfIn PDF document text
    • https://s3.amazonaws.com/julexekubaj/weather_report_chandausi_uttar_pradesh.pdfIn PDF document text
    • https://s3.amazonaws.com/rufonali/jaxumivopilagaxam.pdfIn PDF document text
    • https://s3.amazonaws.com/juvetaso/sijipovoru.pdfIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/why_does_xbox_360_controller_keep_turning_off.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15904f50-899d-4336-97a3-1984c80318ce/lanixepurijisanefit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010421.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10421 6548 bytes
SHA-256: a16d78b4e765d5ee2bbe34147faa0d9708ca9f4bd36cf3b090d8d65c0d41a973
font_01_sfnt_off00011478.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11478 5080 bytes
SHA-256: 95a5082930b89037e776863781117601fa570a3b1f1db0779784ba0ab0d21c7e
font_02_sfnt_off000125a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125A7 1800 bytes
SHA-256: a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620
font_03_sfnt_off00012e34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E34 13260 bytes
SHA-256: 81990093cbb2072480773383f7ee0af2f073d73742b4f14cb521ddacbd30009b

Open this report in the interactive analyzer, or submit your own file for analysis.