Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fca630bf7449712…

MALICIOUS

PDF

83.3 KB Created: 2021-04-07 08:43:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 58f8d0f2c6a6dba5630d81d233f7f5a2 SHA-1: 74f39653716e651270b8e82b8c1d692731b0c79a SHA-256: 3fca630bf74497125087be32437df1258afe31c3aad81b621aeaf4df4c89818c
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=the+power+of+love+song+youtube PDF link annotation
    • http://rurojewof.22web.org/ikea_pax_frame_manual.pdfIn PDF document text
    • http://xenodobile.22web.org/180_day_bodyweight_beast_review.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495526/normal_6025537fae28b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454429/normal_5ff4fa6981120.pdfIn PDF document text
    • http://sugoxebojun.getenjoyment.net/candidiasis_genital_tratamiento.pdfIn PDF document text
    • http://fisusuwisefib.22web.org/6_types_of_probability_sampling.pdfIn PDF document text
    • http://regikumavow.22web.org/zopuwesodikujigipawozutej.pdfIn PDF document text
    • http://fodadasome.iblogger.org/how_long_does_it_take_to_learn_grant_writing.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://cf2e1f24-e5f1-4289-9567-3affce9c164e.filesusr.com/ugd/a4ea6c_76ad2a9d75884021b04021e3d6f998da.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba4d3e8b-2e70-40b9-96da-8ac3017485d0/pumetufipaxakot.pdfIn PDF document text
    • http://gixejemazob.myartsonline.com/96095280034.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4262c365-063f-4e6e-9437-d99f8d71c835/sogotux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/efca8759-fdbb-44c4-a2cb-921210289fed/xubenaledilaliwapaxak.pdfIn PDF document text
    • http://supuwevul.atwebpages.com/tracheostomy_suctioning_procedure.pdfIn PDF document text
    • https://76b44699-1094-4fd8-8d4a-70b7be8159c3.filesusr.com/ugd/c450b2_3a9c48deef6e4b3f9a6e64466b92c58e.pdf?index=trueIn PDF document text
    • http://beralopijabeziz.rf.gd/presupuesto_de_capital_de_trabajo_ejemplo.pdfIn PDF document text
    • http://sakolizel.rf.gd/common_synonyms_and_antonyms_list_for_competitive_exams.pdfIn PDF document text
    • https://45e41439-46a4-4c97-84f0-155cfeda4cef.filesusr.com/ugd/9d7ad9_eec2a7f1b5bd4714b479093ef0558e83.pdf?index=trueIn PDF document text
    • http://sarirasa.epizy.com/canon_g7x_mark_ii_manual.pdfIn PDF document text
    • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_1addfe9946124d03bf1d8e2dbbd10065.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea82a386-8ea3-4b12-941d-ec422472db5d/zuzevozuliwetiteku.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbe2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBE2 5128 bytes
SHA-256: bc1951ab342ea56aceee5947fbaf7bd39f3669141a5a2d129f8e2c3f7e22cb61
font_01_sfnt_off00010d70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D70 10628 bytes
SHA-256: 92adc38d5aab2bae4cd775334f8fb2c7cd4f6ed04d15bc59b4d334f7d9b08472
font_02_sfnt_off000131e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x131E1 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.