Malicious PDF — malware analysis report

Static analysis result for SHA-256 4949bb6a33cd0807…

MALICIOUS

PDF

67.9 KB Created: 2021-03-30 00:03:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f44dcac8b469ab947252845dee928865 SHA-1: 088cacb2b8b3d376fe5a5772e8a32a56b1a264d6 SHA-256: 4949bb6a33cd0807f0b4ef6edeef0b5727048479a41b5cb3a110b733e37bd825
224 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and exhibits characteristics of a link farm designed to redirect users to potentially harmful websites. The heuristic 'SE_LOLBIN_RUN_COMMAND' suggests an attempt to execute commands, possibly involving the URL 'http://zexaxekiki.atwebpages.com/makro_catalogue_february_2020.pdf', which could be a secondary payload or part of a phishing scheme. The presence of numerous external links, including 'https://crophysi.ru/award?keyword=names+of+prophets+in+the+bible+pdf', indicates a strong intent to direct users away from the current document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8294

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=names+of+prophets+in+the+bible+pdf PDF link annotation
    • https://cdn.sqhk.co/doporaba/2VeJggo/53992611619.pdfIn PDF document text
    • http://3bureaureport.info/how_to_use_s_curl_no_dripvh0yd.pdfIn PDF document text
    • https://cdn.sqhk.co/rojarasam/6japrid/how_to_write_a_good_business_proposal_email.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496818/normal_603395f44e1e5.pdfIn PDF document text
    • https://cdn.sqhk.co/xovatagemi/0jjkZgi/masipumumesipibivirem.pdfIn PDF document text
    • https://cdn.sqhk.co/negapevu/gQhjVz0/tool_box_lowes_vs_home_depot.pdfIn PDF document text
    • http://xejopegig.mypressonline.com/lajegefolilano.pdfIn PDF document text
    • http://tozofuji.scienceontheweb.net/audit_report.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451045/normal_5fc7df9ba2f38.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368237/normal_60372b2d67a62.pdfIn PDF document text
    • http://confirmyourverifiedbadge.com/basic_dungeons_and_dragons_modules_5e0woku.pdfIn PDF document text
    • http://clubstore.info/beretta_m9a3_accessories0ojvu.pdfIn PDF document text
    • https://cdn.sqhk.co/bexefoboxevi/dgd3N36/zelle_customer_service_number_representative.pdfIn PDF document text
    • http://leftoutclub.com/835017987166h2jl.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zexaxekiki.atwebpages.com/makro_catalogue_february_2020.pdfIn PDF document text
    • https://044ec7df-721b-4788-b209-87474a3fcb06.filesusr.com/ugd/60ffa2_1cc8316135624dbe991339d7b44be71a.pdf?index=trueIn macro / runtime command snippet
    • https://s3.amazonaws.com/boxalewijim/which_of_the_following_statements_is_true_regarding_a_direct_fixed_cost.pdfIn PDF document text
    • https://s3.amazonaws.com/wegugus/does_a_maytag_bravos_washer_have_a_filter.pdfIn PDF document text
    • http://telusomabufa.onlinewebshop.net/teaching_with_power_3_nephi_17-19.pdfIn PDF document text
    • https://167c2301-eccc-4e3a-a609-38a4f17b9bf8.filesusr.com/ugd/b1dabf_0fcf44a092c24e00958c4a1ec19e9019.pdf?index=trueIn PDF document text
    • http://zexaxekiki.atwebpages.com/makroIn macro / runtime command snippet
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f210.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF210 5392 bytes
SHA-256: 23b610ddc70fd69d30b8ecd02aa7165bd448aa856fa0fa1955c5e03ab062bf46

Open this report in the interactive analyzer, or submit your own file for analysis.