Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f8c173f51335780…

MALICIOUS

PDF

78.9 KB Created: 2021-04-02 01:01:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: cf7d211deaf073655cd6dfcbf3a04b3f SHA-1: b5b8c74403992cd9a35974fef1dc5e86723d54cf SHA-256: 3f8c173f513357804dcdeb7f17ef2559bd697b5ca07f81835a70a6d8ac37aed2
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=years+of+academy+training+wasted+meme+template PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4448096/normal_604753a791396.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380230/normal_602c314456f9a.pdfIn PDF document text
    • http://baxagaxisatipa.22web.org/journey_to_the_west_download_in_hindi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412584/normal_6053d7dfd3265.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467287/normal_5ff4c3ad6e4bb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420431/normal_6058fd1a974e5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lalukegadugubu.epizy.com/the_science_of_psychology_4th_edition_free.pdfIn PDF document text
    • https://ca483b97-61ac-4196-bca0-6b249c18eca9.filesusr.com/ugd/b27199_a68dfbb8fe784db787098d91abe0cf5d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/panalipolifod/84013139648.pdfIn PDF document text
    • https://s3.amazonaws.com/tobobowu/vunaloxolew.pdfIn PDF document text
    • https://s3.amazonaws.com/gavexilatuvitaz/funiculi_funicula_piano_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/juliziwojatige/c_yellow_book_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/lakadutof/place_value_games_for_2nd_and_3rd_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/tugumeb/carboxylic_acid_and_esters_lab_report.pdfIn PDF document text
    • https://f1cb2ec4-a82d-4768-8a06-5236a2db220e.filesusr.com/ugd/a2e20a_85214d2efe0642e3b2ca051f193e01b4.pdf?index=trueIn PDF document text
    • http://xodojes.epizy.com/21969990580.pdfIn PDF document text
    • https://s3.amazonaws.com/legenapi/sivapuranam_tamil_mp3_download.pdfIn PDF document text
    • https://s3.amazonaws.com/zasepo/92707606234.pdfIn PDF document text
    • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_969d2824667b40ec9f46986f6debe07a.pdf?index=trueIn PDF document text
    • https://55963656-6eb1-4b25-bcd5-bb835d65808b.filesusr.com/ugd/0064ae_e0750e7ed7344e3998e4ec6af645eb7e.pdf?index=trueIn PDF document text
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_8a8ef43ea0f34e9d8b1a6889bc8cfa81.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vapelurowar/bash_shell_programming.pdfIn PDF document text
    • https://s3.amazonaws.com/liwara/zabuxerugiwidowal.pdfIn PDF document text
    • https://s3.amazonaws.com/jozaponi/correct_order_to_watch_marvel_movies_reddit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB79 5632 bytes
SHA-256: 5732d9f4aeb8dc474f5d720882737a09d23e59257e6444ad0dc22ad8d5b84f65
font_01_sfnt_off0000fea5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEA5 2060 bytes
SHA-256: 8c5f596b751b5df4f2110414aaa1c630b67d90a9bc37611b1def66c0a15a082c
font_02_sfnt_off0001083e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1083E 11176 bytes
SHA-256: 49e9bc7dfab405708c6108630965f4e978110dd58dfe1fd54dd7009ec196ca6a

Open this report in the interactive analyzer, or submit your own file for analysis.