Malicious PDF — malware analysis report

Static analysis result for SHA-256 4844c83bfa878b7a…

MALICIOUS

PDF

51.0 KB Created: 2020-12-08 20:42:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 38619af604224bc99c5050e4a92e7f00 SHA-1: faadf843a2d32e5214713ba9e6713b9d05c6ab00 SHA-256: 4844c83bfa878b7abbb4724f59dad9a8fd3edcc3ef34582b0c0d1d85350cbb57
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9326

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/wb?keyword=states%20of%20matter%20simulation%20worksheet%20answers PDF link annotation
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/sefaritonos-nukivafeka-retisebop-regaxumex.pdfIn PDF document text
    • https://dusexitope.weebly.com/uploads/1/3/4/6/134646398/9944119.pdfIn PDF document text
    • https://lawofudoto.weebly.com/uploads/1/3/4/8/134854676/nijoxida_vologozi_lufuvedat_nevawun.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419822/normal_5fc557356bf30.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbfd18111f6a419847f67ca/t/5fcabc2bb3233311c26cb3c0/1607121964237/dusedevoduvuridevew.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe264d4e98326c02d97c05/1606297165939/classifying_triangles_worksheet_gina_wilson.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6a9a424b06a7eb327d53d/t/5fce5a17eb18547f4bb69d91/1607359000715/28636108189.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf48f3145a8629dca706a5/1606371572223/fiverr_conversion.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6b9d1c43b171198859c62/t/5fc7e76de3db732bc6c68df8/1606936437966/17437250241.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5c45068612547ed7f5dc1/t/5fca9e78ee0d180abe818101/1607114362468/muguj.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b76c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB76C 5264 bytes
SHA-256: 1929e96593c405fd7ceaa69681666b298b9ea7c29779671239e645c6a087af1e

Open this report in the interactive analyzer, or submit your own file for analysis.