Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a168bd724e506c7…

MALICIOUS

PDF

79.7 KB Created: 2021-03-09 20:17:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 13dca8447b9f5526460f80d204800024 SHA-1: 2b41c2daa5a3ffe564f44bdcdcc4e1e59c5b9fbd SHA-256: 4a168bd724e506c78bd60ce5ba9950730f0f606c26c2fc85ceb853dfd998538e
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=wagner+power+steamer+715+reviews PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4391896/normal_5ff129469ce19.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369150/normal_600a405c32de0.pdfIn PDF document text
    • http://2gusevshop.space/geometric_template_powerpointyoatr.pdfIn PDF document text
    • http://taforojujutusig.mygamesonline.org/can_a_cracked_heat_exchanger_be_dangerous.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446636/normal_601029c7b4bd6.pdfIn PDF document text
    • http://particuliers-societegenerale.xyz/united_airlines_carry_on_baggage_size_and_weights56wi.pdfIn PDF document text
    • http://nadipewin.mywebcommunity.org/why_is_my_fridge_leaking_water_inside.pdfIn PDF document text
    • https://cdn.sqhk.co/rujamuzizogo/d1Qgiie/sunday_school_lessons_lifeway.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482860/normal_60157a10ddb8b.pdfIn PDF document text
    • http://espaceabone.com/compressed_sheet_mask_diysfila.pdfIn PDF document text
    • http://pusapev.scienceontheweb.net/agostinho_neto_sagrada_esperana.pdfIn PDF document text
    • https://cdn.sqhk.co/rasepotobami/hjb1ggh/medaram_helicopter_price_2020_from_warangal.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zakunafu/45640757205.pdfIn PDF document text
    • http://minivenema.atwebpages.com/16676747109.pdfIn PDF document text
    • https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_83b8b6c6b5924a358d6c622043cb9d38.pdf?index=trueIn PDF document text
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_08b5d88d1380403a816b5a7b3a7e0072.pdf?index=trueIn PDF document text
    • https://29ce6865-365c-47c4-9f0a-635d6f965865.filesusr.com/ugd/0d6b77_5f38e97d79d147ab8d186f973c1fa495.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wulagisi/dell_optiplex_9020_mt_ram_upgrade.pdfIn PDF document text
    • https://s3.amazonaws.com/tesasubawalozan/calendar_template_for_powerpoint_2016.pdfIn PDF document text
    • https://cae2aa39-5014-47ec-b549-0fed73f36d02.filesusr.com/ugd/c8683e_5e631fe96706462eb450753ffb406e18.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tunenijexe/alpha_brain_waves_music.pdfIn PDF document text
    • https://s3.amazonaws.com/midaguvimabof/82954178736.pdfIn PDF document text
    • http://nivuzujanux.myartsonline.com/337038211.pdfIn PDF document text
    • https://9d1e48ad-bcd7-4831-9b7b-7108443a63b6.filesusr.com/ugd/136d07_1fb8d1a25e3b4c6d9b671f2f1375e3a0.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f796.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF796 5528 bytes
SHA-256: ed605bf573a49f35af978840a3a9e153ea61f79d7cc4a2798f8e42e02f8a7652
font_01_sfnt_off00010a7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A7D 11100 bytes
SHA-256: 0849f4bf0a5f012bdd791d481e795eea5f09f306ef5ab29dd56c210be8619849

Open this report in the interactive analyzer, or submit your own file for analysis.