Malicious PDF — malware analysis report

Static analysis result for SHA-256 356d94b0fac3764a…

MALICIOUS

PDF

75.6 KB Created: 2021-03-19 23:03:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: ae83577b533b9f22b8cb8d940063b760 SHA-1: 9c6504c92f48e613dff98281ce6bce2ceb3c88e2 SHA-256: 356d94b0fac3764a8ed655d701b4358e9ff3cc3f81302e9a57cab501ea4de4da
166 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a remote-support lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/wix?keyword=forecasting+weather+map+worksheet+%25233+answers PDF link annotation
    • https://cdn.sqhk.co/nadetajagupe/clgfvyc/2020_land_rover_defender_configurations.pdfIn PDF document text
    • http://profer-opt.ru/momuregetun1pkee.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462056/normal_5fedcb16ad4a0.pdfIn PDF document text
    • http://rosutob.getenjoyment.net/bersa_thunder_380_pocket_holster.pdfIn PDF document text
    • https://cdn.sqhk.co/lemipetukaso/chjil3C/3545337078.pdfIn PDF document text
    • http://zakosemej.mypressonline.com/who_manufactures_sears_snow_blowers.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490936/normal_5fd1775a7b97e.pdfIn PDF document text
    • https://cdn.sqhk.co/duzemata/biihjf9/splashtop_streamer_exe_download.pdfIn PDF document text
    • http://vkrowl.com/radio_code_free_calculatorju813.pdfIn PDF document text
    • http://tejovotemikodes.getenjoyment.net/toderuzifepureborovelaxe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484993/normal_601260c7e68e2.pdfIn PDF document text
    • http://jebebixazonutug.mypressonline.com/29210533148.pdfIn PDF document text
    • https://cdn.sqhk.co/feketukadoz/ibJCMsE/pojewov.pdfIn PDF document text
    • https://cdn.sqhk.co/wutalididow/hYhbJhe/p_word_love_hd_wallpaper.pdfIn PDF document text
    • http://nafarami.medianewsonline.com/jiwizotaximof.pdfIn PDF document text
    • http://bettyloustintruckbbq.com/section_8.3_dna_replication_study_guide_answerspksez.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409997/normal_5fe815b0b44c7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_6f6650672c1a44f6b1032b3c5b695662.pdf?index=trueIn PDF document text
    • https://f608bf75-187c-4b28-9621-af925c05c2b6.filesusr.com/ugd/05e3ad_5d62c76b99134d148831eb35c820e85a.pdf?index=trueIn PDF document text
    • https://8ed7b8cb-9bae-4def-ad9b-66b28cd11f91.filesusr.com/ugd/740d8c_7b66ef5a67064b869f0f1b3958db28e5.pdf?index=trueIn PDF document text
    • https://168d2a81-f750-40c6-a653-3787650f980d.filesusr.com/ugd/3bcfef_0130a5a1cd944983be2137eb933350fa.pdf?index=trueIn PDF document text
    • https://2e8e3215-33bf-4fe1-bc67-b38dac560527.filesusr.com/ugd/269bb8_54e5ef7427e64a779452ed2f3df16bc3.pdf?index=trueIn PDF document text
    • https://18cceff7-6d50-42ec-9d85-67184b61345e.filesusr.com/ugd/8c2e83_13ae605c0dab41e8bdec86d2bbbc259b.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e825.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE825 5428 bytes
SHA-256: 192e277f8672368310ee32ad4243905b31a3a7aac9a279a90cf83c50699c4383
font_01_sfnt_off0000fa85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA85 11208 bytes
SHA-256: 277e351abfba5f64451f3db9517df9f421e13bb8e908cf1640bbee13e058d4a7

Open this report in the interactive analyzer, or submit your own file for analysis.