Malicious PDF — malware analysis report

Static analysis result for SHA-256 38151759b1add86b…

MALICIOUS

PDF

72.7 KB Created: 2021-04-11 09:10:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: ba4187f1fe090846facedb84f049b185 SHA-1: 8da54210cb61da374e4665c06caca2891d8c1cea SHA-256: 38151759b1add86bdeb3353fbc72012637c6e1185489abbd2f59fb4c7f8a0e06
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=ethiopian+grade+10+biology+textbook+download PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_9f2427fbe94246edb42e9c7d546dfe5a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b2c1448-db74-4680-b65d-783cb09e1a94/verizon_fios_customer_service_en_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/arthrex_prp.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3b08b4a-2daa-4bf7-8e4f-1c11f89d6d48/29924299533.pdfIn PDF document text
    • https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_33335d5d662048758d01645e827ccfaf.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2d8d0aa-7f91-4294-b0b1-704be959d410/11624008706.pdfIn PDF document text
    • https://ef9d90ca-5811-4a1c-810e-75bcfae60121.filesusr.com/ugd/a33af7_723086b93a814076a981c5b28cf41b51.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mejobu/adapting_to_the_environment_haspi_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/pesetufavo/clicker_universal_keyless_entry_instructions.pdfIn PDF document text
    • http://titomukoma.rf.gd/33802782932.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ce5fa7d-7a32-402f-b320-fe0db8a6badb/earth_science_guided_reading_and_study_workbook_section_24.1.pdfIn PDF document text
    • https://s3.amazonaws.com/pujirageg/45080943727.pdfIn PDF document text
    • https://b64dd490-e5b9-492f-89ff-e398ecee904c.filesusr.com/ugd/5926b4_9e7bd7ad526549258d3c2c98b310b7fd.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/legapatatezisa/wukakuf.pdfIn PDF document text
    • https://s3.amazonaws.com/tadevewuju/ramudezusefabekaxozuvala.pdfIn PDF document text
    • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_0393c28383e9423aa3893f6c84eb0e9b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a9251e5-7f45-48ef-a6a4-ba57f48d5732/kojivuwifisajuwolov.pdfIn PDF document text
    • https://s3.amazonaws.com/meludav/gda_bylaws.pdfIn PDF document text
    • https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_14891d70a02542ff8241bbe86bb950dc.pdf?index=trueIn PDF document text
    • https://8b8c7005-3af0-45a1-8e5b-a6902caa9335.filesusr.com/ugd/dbd7d9_2906e98c70964b9d95685ae4de34751a.pdf?index=trueIn PDF document text
    • https://e924225a-aa46-4bfc-8e56-7341551e1833.filesusr.com/ugd/54dfea_16f29be43e8e41f38658c0a922843e2b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/berlinski_kongres.pdfIn PDF document text
    • http://sizosuxexe.epizy.com/naroto.pdfIn PDF document text
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_8827af7401d34e26bad1afe1e45cf727.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dda4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDA4 5660 bytes
SHA-256: 5e6bf1fe6dcac8306864c9ac2470b09fdf488622276b2996bfcb45814a94502e
font_01_sfnt_off0000f0fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0FC 10560 bytes
SHA-256: d18d1e0c3a9d9d052adcc6f79a7063de7d47742284c8a1e356638f1262b6322e

Open this report in the interactive analyzer, or submit your own file for analysis.