Malicious PDF — malware analysis report

Static analysis result for SHA-256 32614363a39658d8…

MALICIOUS

PDF

76.8 KB Created: 2021-06-08 20:26:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 26adce80fcdfd5d4e057e8c5b3eaf19e SHA-1: 840bdc2fec499e527f501966c9aa359d4908d0b9 SHA-256: 32614363a39658d8f709f8b44c0ace4dd82d5fcab30ee68a170ef735d4ef7931
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=god+bless+america+kate+smith+sheet+music PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4496602/normal_6028bbaf76d87.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4504870/normal_5fe63c1412f45.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460466/normal_60472ec15d6ee.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/01d30aa6-d1d8-45c3-b90a-dd95d6254c47/mipilewerenomijewazazigis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48654ada-3477-47d8-b4e3-d16623e137b3/58598714426.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d1a0c83-7911-4e2c-bf5f-f77b30235c9c/christ_is_risen_matt_maher_chords.pdfIn PDF document text
    • http://rupebaxo.pbworks.com/f/sas_zombie_assault_td_mobile.pdfIn PDF document text
    • http://vinukena.pbworks.com/f/how_do_i_install_adobe_reader_on_vista.pdfIn PDF document text
    • http://papedisuk.pbworks.com/w/file/fetch/144799050/weropezarab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/216f2150-f68f-43a4-b603-f9d809b14930/what_is_the_fastest_rapper_alive.pdfIn PDF document text
    • http://nikekuva.pbworks.com/w/file/fetch/144426627/how_do_i_file_a_new_unemployment_claim_in_oklahoma.pdfIn PDF document text
    • http://sakulibur.pbworks.com/w/file/fetch/144627354/redujudegevokufukelerob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/528f9814-c797-4d86-8af2-cf9c7091cd6e/ms_marvel_kamala_khan_age.pdfIn PDF document text
    • http://ziduzobif.pbworks.com/f/krunker_working_aimbot_-_krunker.io_hack_aimbot_esp_bhop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72e4f8f2-3ded-47ad-814d-091723ba663e/how_to_pair_remote_to_hopper_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5af0d895-e304-4bba-a9d0-b40edf72e63c/reloading_low_pressure_signs.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE27 5416 bytes
SHA-256: 9217348d2b9900ea223d83707cac49cf257f1c6450e6259b27c5d075d9c057d0
font_01_sfnt_off00010064.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10064 11172 bytes
SHA-256: ebdc7ce05cb91c397152d750832da529b64c44c39b6716a46a94c16f37b95096

Open this report in the interactive analyzer, or submit your own file for analysis.