Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c07c201e3a277d3…

MALICIOUS

PDF

78.3 KB Created: 2021-03-19 05:35:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: acbef03cf212130629c7491587895dc0 SHA-1: 2e52b3b49ed5c22e60f82c59785b6f5b65cc749a SHA-256: 3c07c201e3a277d396896db53e1159dba71fd2d24234ffcff3625f7b74e97e76
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=days+of+the+week+worksheet+sparklebox PDF link annotation
    • https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/vegejavome-pubakuwamojew-tuwimotof-gedewamajum.pdfIn PDF document text
    • https://cdn.sqhk.co/suxujaba/bjalhig/zokozune.pdfIn PDF document text
    • https://cdn.sqhk.co/vuzilogabuwu/jHgdQhd/tiziriwuvusixurur.pdfIn PDF document text
    • https://nigafabap.weebly.com/uploads/1/3/4/3/134377596/ab15f26c077.pdfIn PDF document text
    • https://dikasawo.weebly.com/uploads/1/3/5/3/135349802/8165956.pdfIn PDF document text
    • https://cdn.sqhk.co/bibikodazit/bOghgig/lumefifezevel.pdfIn PDF document text
    • https://taxajoberaruvu.weebly.com/uploads/1/3/4/3/134320235/5438f142891.pdfIn PDF document text
    • https://patewowuxafopon.weebly.com/uploads/1/3/4/5/134595548/depavite.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://41be308f-8a64-4dec-8b30-4937605be974.filesusr.com/ugd/f042fe_8e355274d849448bbe97dfbc48196de4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jemisajoda/does_home_depot_carry_honda_generators.pdfIn PDF document text
    • https://025b4bf0-2906-4f5f-8a0f-6d4b68fc9518.filesusr.com/ugd/148ee2_6660144ce76847a580b022d44120e28f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bevekizadoxuj/jogosobusipikefurak.pdfIn PDF document text
    • https://6d1a2d78-ebd2-4140-94a0-411197be5b5f.filesusr.com/ugd/88ff89_0e1dd50c8f5e4497a09b783704a1ca2b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/foneniz/realidades_3_writing_audio_video_workbook_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/viboxikuz/75695275869.pdfIn PDF document text
    • https://s3.amazonaws.com/dozore/80002002588.pdfIn PDF document text
    • https://d0a6b1b1-1773-4622-8b5e-0ab5990a7ed3.filesusr.com/ugd/b90ba1_76142475f52e4f6292224920d58207eb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5cdf7e2f-4c53-4956-9e56-172facfee672/hp_elitedesk_800_g1_twr_memory_slots.pdfIn PDF document text
    • https://s3.amazonaws.com/farowug/gay_science_nietzsche.pdfIn PDF document text
    • https://s3.amazonaws.com/bajuse/anodised_aluminium_sheet_cladding.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9189da4-34cf-4b20-a5f2-bff1bf970bdb/why_wont_my_hp_deskjet_3755_print.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f454.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF454 5456 bytes
SHA-256: c9fcd0140977ae6006a1d40ee245ba8bfcee496be2bddf687643cbc6a0c40d46
font_01_sfnt_off000106fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106FE 10704 bytes
SHA-256: e7e32fc9841d575739449c82bd143e0652ee02f637e93f222d843badb2d8b5cd

Open this report in the interactive analyzer, or submit your own file for analysis.