Malicious PDF — malware analysis report

Static analysis result for SHA-256 4562fd84e731f38a…

MALICIOUS

PDF

78.3 KB Created: 2021-05-26 03:46:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 229545c2f7d5d26e84c39af07510c4d3 SHA-1: 10fa9eb76d4b20354e1f60b89b9533c047e0e9c4 SHA-256: 4562fd84e731f38a9252ed03a8166e91698a6eda8501aeb94b0a1372d42fe329
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=minecraft+pe+0.9+0+apk PDF link annotation
    • https://zodaribidibukez.weebly.com/uploads/1/3/4/7/134716266/a7fbdd5.pdfIn PDF document text
    • https://wunogalet.weebly.com/uploads/1/3/4/8/134891918/korobel.pdfIn PDF document text
    • https://funopazotasar.weebly.com/uploads/1/3/1/0/131070342/7c7d37512bc7a76.pdfIn PDF document text
    • https://netigiru.weebly.com/uploads/1/3/4/5/134501210/9347767.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/df32e9af-c64f-4906-976c-a8fb0e1285a1/are_duraflame_heaters_energy_efficient.pdfIn PDF document text
    • https://s3.amazonaws.com/zabejuvijolu/gusewikuzilo.pdfIn PDF document text
    • https://s3.amazonaws.com/tutasujal/trumpet_sheet_music_free_popular_songs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ba0c272-a773-4097-adba-a6a091ec4e28/virozujo.pdfIn PDF document text
    • https://s3.amazonaws.com/punurum/much_ado_about_nothing_1993_full_cast.pdfIn PDF document text
    • https://s3.amazonaws.com/dewutexorob/confederate_army_uniforms_at_gettysburg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/772305ff-92c1-422b-bba1-82d71fa9331a/graco_nautilus_3-in-1_car_seat_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fdd164c-ccc1-4d3e-95eb-a9398745379b/echo_cs_400_parts_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/barfi_laddu_title_song.pdfIn PDF document text
    • https://s3.amazonaws.com/viwoxuz/firase.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4006444-f0bb-4712-bc8f-23cb42df9f80/vosilatugurap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b270f1c4-dc0d-4be2-b00a-e43e715cc9f3/chicco_keyfit_30_car_seat_washing_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/08e19f6c-0bad-466d-a1d9-90e290075da8/95653815057.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42bf55eb-7156-456c-b4f5-afe6ccae85d1/how_to_thread_a_singer_sewing_machine_stylist_513.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dcd4e615-2781-45f8-96a6-dd2b594a386d/22532934996.pdfIn PDF document text
    • https://s3.amazonaws.com/bipovoromoj/dipopawuduwivetumaliletad.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f270.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF270 5196 bytes
SHA-256: 3e2799ef3941e032701f354a2f18ac634333003a841579041caacdcc5a9746a9
font_01_sfnt_off0001044a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1044A 11584 bytes
SHA-256: 0c4a91e973e3d8c212b044f7dd7ed55987cd279a43d5b42858b4a07232b58dff

Open this report in the interactive analyzer, or submit your own file for analysis.