Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f195cb946ee6ea1…

MALICIOUS

PDF

117.7 KB Created: 2021-03-14 05:44:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: b477ac717eb784c39fc7c9c7158ecc65 SHA-1: 770717958815392092fdae5b51a188f338535d2b SHA-256: 3f195cb946ee6ea12325195fd6e1cdaf4ab4e78abef818b910e3fa29edd9ccf7
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link farm with numerous external URLs, many hosted on disposable domains, suggesting a phishing or spamming operation. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' indicate a deliberate attempt to create a network of links for SEO manipulation or to distribute malicious content. The ML classifier and ClamAV detection further confirm its malicious nature, likely as a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=do+orthodox+christian+believe+in+trinity PDF link annotation
    • https://cdn.sqhk.co/pigevikuwi/hjWHjbb/odds_to_win_national_championship_college_football_2021.pdfIn PDF document text
    • https://jimekijan.weebly.com/uploads/1/3/2/8/132815057/bipipaduxebuzi.pdfIn PDF document text
    • https://cdn.sqhk.co/bexamajuw/kcwqghx/table_tennis_ball_thrower_machine.pdfIn PDF document text
    • https://tenekitu.weebly.com/uploads/1/3/4/0/134018212/gajomigirupepam-zojaw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483587/normal_602ec574b7686.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414332/normal_600f9e2c99b70.pdfIn PDF document text
    • https://cdn.sqhk.co/wibononuve/cunifij/ivar_the_boneless_hair_tutorial.pdfIn PDF document text
    • https://rapodiduwegez.weebly.com/uploads/1/3/5/3/135311990/konobasases_vipiko_napunesi_wepigawexubuwit.pdfIn PDF document text
    • https://cdn.sqhk.co/zoluwumenad/dZyicjd/induction_cooking_heater_in_pakistan.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413242/normal_6030fef384218.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4375344/normal_5fcf3c6e1a558.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451970/normal_5fe519b805552.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://f77c8dad-41d7-4a8f-8d8d-c05149a3a236.filesusr.com/ugd/36d413_603dd38c1c2e4639b3702284a8ef4e58.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pugomonapoxuxe/apc_back-ups_xs_1000_manual.pdfIn PDF document text
    • https://f6e2a16f-d004-42cd-8f17-0463e090774c.filesusr.com/ugd/c70c35_a349f41e786c423abca6490f19b6bb2a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fefurorobumi/better_homes_and_gardens_walmart_sheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36f54fd1-3419-4a16-861b-62136f1fa0bf/28972866353.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe400127-4432-4769-b07f-033d146bca7e/zebaxuvana.pdfIn PDF document text
    • https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_11115ec662df4723b60ac29f6070d91c.pdf?index=trueIn PDF document text
    • https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_fbfe06626eb14e5cb9b5bd8dd6430fa5.pdf?index=trueIn PDF document text
    • https://a7563df4-ba19-4d82-a8a0-b2470d957038.filesusr.com/ugd/61f964_a5f22072c8d0443b93350ac05fc5644c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017a5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17A5F 5184 bytes
SHA-256: 17515db19483ed2fdcc5fb689ef1c43a61dd4b764eb0a4b6ed83e840b77e64cb
font_01_sfnt_off00018c04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18C04 13736 bytes
SHA-256: a1eb88819289adbac13fb995001f771d26cd3e7cc0a68f2b757656467016edf9
font_02_sfnt_off0001b930.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B930 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.