Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a1f6470c0441fcf…

MALICIOUS

PDF

113.2 KB Created: 2021-03-17 03:33:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 5d7194e96375477bc8e19f472fc38e50 SHA-1: 43b266921a970f9da5aeedda89b8d9a1150a1fd6 SHA-256: 4a1f6470c0441fcf9f8208e18a1bd897e6a82748753214ef572d287636db424d
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6388

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=sejarah+bani+umayyah+dan+bani+abbasiyah+pdf PDF link annotation
    • http://dfds.in/maiden_voyage_sea_of_thieves_key_locationikmuo.pdfIn PDF document text
    • http://theharaka.online/duvabodubavadobodah6l4r.pdfIn PDF document text
    • http://daddytestit.xyz/qu_idiomas_se_mezclan_en_palabras_como_parquear_y_chequeari5qik.pdfIn PDF document text
    • http://nutusugeralinet.mypressonline.com/bodotewebutawig.pdfIn PDF document text
    • http://joblanc.xyz/44264128725ldou3.pdfIn PDF document text
    • http://istra-backwater.ru/alan_watts_falling_in_loveb8v36.pdfIn PDF document text
    • http://gokojemisivuf.22web.org/ammy_virk_jutti_video_song.pdfIn PDF document text
    • http://reestr.site/adding_and_subtracting_roman_numerals_worksheethuuvo.pdfIn PDF document text
    • http://goodxday.xyz/92068916523o77ff.pdfIn PDF document text
    • http://xoziduso.mypressonline.com/colt_ar15_pistol_lower.pdfIn PDF document text
    • http://shoes-storie.club/juvivusaloxesonanoscfmyo.pdfIn PDF document text
    • http://tebogekememesij.mygamesonline.org/grammar_english.pdfIn PDF document text
    • http://eferevole.com/former_latter_rain_bible_verseuts86.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/72dbc680-fc89-40a9-b654-ace47ac6102b/66058819035.pdfIn PDF document text
    • http://pimovutune.rf.gd/android_app_icon_generator_online_free.pdfIn PDF document text
    • https://s3.amazonaws.com/sepovutapakogaf/monster_hunter_world_armor_upgrade_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fdf737d-c748-474f-81d6-59df08579b7f/norton_reader.pdfIn PDF document text
    • http://ludujefu.epizy.com/16142764782.pdfIn PDF document text
    • http://bitizadixiriwen.epizy.com/91815690519.pdfIn PDF document text
    • https://s3.amazonaws.com/nitirew/is_maximum_ride_the_movie_on_netflix.pdfIn PDF document text
    • http://magelul.epizy.com/business_plan_application_form.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1a54d11-14ef-421c-afb5-0c8ea8eb1484/bebojenozawosadumeda.pdfIn PDF document text
    • https://s3.amazonaws.com/suzujewa/zijoma.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2961d10-8b54-46ae-9953-ec4a3f5fe3e0/why_are_my_desktop_shortcuts_not_working.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0001b8a6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B8A6 6517 bytes
SHA-256: ff3e8d8ef4f23649083467f6e925ea91b6ddc1b8b12e9037c03885a97b0e83bf
font_00_sfnt_off00017ea0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17EA0 5668 bytes
SHA-256: 63e12438e25dc723d46d1c42400b8fa20a62fb43ec8f682d0b4420bdb8f15c79
font_01_sfnt_off000191c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x191C3 11708 bytes
SHA-256: 780220ae7fe77f89f824d73a2167e0d524d58469cfd2e827ff53ef891e5055f3

Open this report in the interactive analyzer, or submit your own file for analysis.