Malicious PDF — malware analysis report

Static analysis result for SHA-256 300688963e98d9b7…

MALICIOUS

PDF

88.2 KB Created: 2021-04-24 02:53:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 1842c676a86acf3f7fa145e6a45ad77b SHA-1: 52036fbc9a1eaeae7d758b5cfa8f67dcfc27bc1c SHA-256: 300688963e98d9b7fe17095927debe2b7841cebbcb7e6a5ece925c714b53fd46
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+manly+p+hall+died PDF link annotation
    • https://tigisara.weebly.com/uploads/1/3/4/6/134651617/7623465.pdfIn PDF document text
    • https://cdn.sqhk.co/vulovosovem/bfheISR/katijoxiroxozepinim.pdfIn PDF document text
    • https://marotebage.weebly.com/uploads/1/3/4/7/134712984/9425592.pdfIn PDF document text
    • https://cdn.sqhk.co/vopiruwikil/bdgfhji/pufituzodepagadafif.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381291/normal_5fcd268223d9e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372723/normal_606b73cdad9ff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470696/normal_606e3012a466a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384160/normal_604e25e9d72d8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421048/normal_605ef706822f0.pdfIn PDF document text
    • https://cdn.sqhk.co/suzeboxiwo/ihgdcQc/ziridenopomeneda.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://b1e6e3cd-24a2-426a-8b7d-e8f4bd81915b.filesusr.com/ugd/83e584_a25cb4d058c94651be79372eeafee027.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed46c5a3-1fcc-4646-a285-8fb4068605ad/44183576987.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3269acd2-0c9d-4279-9df7-68fbaede3306/garmin_zumo_660_updates_free.pdfIn PDF document text
    • https://6ba7316d-b84b-4ccb-a32a-103c856d4013.filesusr.com/ugd/91f37e_77ccb14480424f85bf570ca4e88c2829.pdf?index=trueIn PDF document text
    • https://da9d63b4-fbfd-4f6f-88e7-06ac0d76355b.filesusr.com/ugd/ca300b_4dd68392faf046b7a7dd5d3983eec010.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/98a717c6-c4e8-4b52-8209-1a7f91f1fa63/sazulidobidegawomopulekad.pdfIn PDF document text
    • https://fb79ad55-22b5-4823-9538-35c71bbbd514.filesusr.com/ugd/ea423f_806d6c5c46bc4ef4a82b6993a8c31c20.pdf?index=trueIn PDF document text
    • https://79ab8074-8148-4faa-9219-f6cdfa35bc15.filesusr.com/ugd/99e004_69beffddbcc9496e98b25a53495a3e24.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010eed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EED 4788 bytes
SHA-256: 313ed9ec583d18227c099e1800dce25ebcf17f46bd21e65b543f6a8f29d7e85a
font_01_sfnt_off00011f03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F03 11300 bytes
SHA-256: 2d208c69949d9285c59e7148b276a6cf66edf0b97bbd2e57fc93d8fbd77e993b
font_02_sfnt_off0001459d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1459D 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.