Malicious PDF — malware analysis report

Static analysis result for SHA-256 30ea592662404b5a…

MALICIOUS

PDF

80.9 KB Created: 2021-02-27 08:18:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: da7cc2b4543aeaa80d95a1f8af3652a7 SHA-1: 14324b9d689486d551e93583d5eb4c3bcc21231e SHA-256: 30ea592662404b5a788dedbd5cbae7fc7fadb2a703bd9cef92a9d15ac6225a69
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7410

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=price+of+32+inch+samsung+tv+in+kenya PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4499999/normal_5fe23e301b4e8.pdfIn PDF document text
    • http://lagutobokoza.22web.org/6178359101.pdfIn PDF document text
    • http://wunutomerar.iblogger.org/inspiratek_posture_corrector_step_by_step_guide.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473938/normal_5fe5538277c69.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444369/normal_5ff33d0b1e3b4.pdfIn PDF document text
    • https://jefogozadiz.weebly.com/uploads/1/3/4/0/134040800/2c52da71a5.pdfIn PDF document text
    • https://goguribepolim.weebly.com/uploads/1/3/0/7/130739596/55f56b6ff61.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416932/normal_5fcb9f0ae042c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471512/normal_6014d15481f37.pdfIn PDF document text
    • http://cocobuka3.xyz/posajijeabwn2.pdfIn PDF document text
    • https://gejeximiba.weebly.com/uploads/1/3/4/8/134897602/dc5d162c7fea.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382962/normal_5fdeaaa2d1c8b.pdfIn PDF document text
    • http://douchehq.xyz/national_bridge_card_gameihwdy.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481667/normal_5fd348456cf48.pdfIn PDF document text
    • http://boviriso.22web.org/gemaferenibage.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kusegewamuzazod.epizy.com/p6_eppm_administrator_s_guide.pdfIn PDF document text
    • http://vogizopenukese.epizy.com/80691956293.pdfIn PDF document text
    • http://runesufosufej.rf.gd/2005_ranger_boat_owners_manual.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f986.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF986 5784 bytes
SHA-256: ad66924d6f32fe04e3a84f6ccd954ab3b095c4953d486a6c565bc5ed3b7359cc
font_01_sfnt_off00010d28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D28 10772 bytes
SHA-256: eda8f98796adfab266e9b4b4fb3134435b802a5aeb8ab961fa789f49f9f4993a
font_02_sfnt_off000131b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x131B2 16140 bytes
SHA-256: 1ffca1ef16be5e2ec436e77f9211a88ad3199dc781cb76600401cc2e2c7dce6d

Open this report in the interactive analyzer, or submit your own file for analysis.