Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ab2b7c4cc37d32b…

MALICIOUS

PDF

76.6 KB Created: 2021-03-16 08:05:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 76327fc9999ae5ff93fe9aaf0811bde7 SHA-1: 1d58c7d06d3525ba693247e0f8e261d073aa3482 SHA-256: 4ab2b7c4cc37d32b5d14ba065dfff7fa6d5f6e1471e9bd352c60e080d4250fc0
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=daring+greatly+workbook+pdf PDF link annotation
    • https://cdn.sqhk.co/sadudolamom/K3jfnEf/44555541502.pdfIn PDF document text
    • http://jijuduli.mywebcommunity.org/46216041590.pdfIn PDF document text
    • http://gopudumimipabol.mypressonline.com/reliability_analysis_for_structural_design.pdfIn PDF document text
    • http://zuregazezoral.mygamesonline.org/nujinikoseroxudo.pdfIn PDF document text
    • http://sevagawos.getenjoyment.net/craftsman_pro_series_10_contractor_table_saw_review.pdfIn PDF document text
    • https://cdn.sqhk.co/bevizewo/thZwcij/surprise_eggs_games.pdfIn PDF document text
    • http://roxelejabojafe.scienceontheweb.net/definition_of_family_in_sociology.pdfIn PDF document text
    • https://cdn.sqhk.co/bisuligiga/hiiwaie/kowujedesukilaja.pdfIn PDF document text
    • https://cdn.sqhk.co/digatamale/3N8icfw/hook_neon_pink_nails.pdfIn PDF document text
    • http://jogajep.medianewsonline.com/ninemozojogubefaloruwite.pdfIn PDF document text
    • https://cdn.sqhk.co/patizuruf/gODibYk/4703427559.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://502f924d-676a-41b3-8220-87c01882f600.filesusr.com/ugd/5a20bb_268981ecb5a946a9aba4515c52a2c613.pdf?index=trueIn PDF document text
    • http://jilawovo.epizy.com/gk_questions_and_answers_for_class_5.pdfIn PDF document text
    • http://kesupipipiret.onlinewebshop.net/fisco_agenda_2020_gratis.pdfIn PDF document text
    • https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_e7de63ff98fa48f4a300157ee39a1101.pdf?index=trueIn PDF document text
    • https://737bf953-b780-43bc-8af0-312ed5328a40.filesusr.com/ugd/017c44_ecb0455c47a846c1bb9e4346837edb5c.pdf?index=trueIn PDF document text
    • http://leronusofawu.epizy.com/how_to_use_a_rug_doctor_uk.pdfIn PDF document text
    • http://jigosip.epizy.com/bareilly_ki_barfi_hd_movies_counter.pdfIn PDF document text
    • https://5d94d51b-2702-4b64-8df3-eadd022f3edc.filesusr.com/ugd/2ddd39_6fb7723ffe0845189fc8459920dd2f2f.pdf?index=trueIn PDF document text
    • https://41d9b059-0b17-466b-96e6-f31a3f3e9b19.filesusr.com/ugd/f1ead9_3221e31acfaf4f44886bbc866693cd3c.pdf?index=trueIn PDF document text
    • https://7e574f8b-ef34-4833-8dee-b18f3ac9fc91.filesusr.com/ugd/af8ffd_123f2099cd584e6e94e7ba264bb14aef.pdf?index=trueIn PDF document text
    • http://valupakukav.myartsonline.com/22775724665.pdfIn PDF document text
    • https://53860ffb-5975-4088-b838-5c82367c2827.filesusr.com/ugd/0d2908_65fc316b6cea4712a0c9efa2fbbb7b1d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebbe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBBE 5428 bytes
SHA-256: 5074de8d29f0472712a68000d64437254a873d7d3040f1159bf143e941f5898e
font_01_sfnt_off0000fe66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE66 11408 bytes
SHA-256: f7958f5745937316f47adcbd4bbfffca9a749738e182c8205e263f4177a4a059

Open this report in the interactive analyzer, or submit your own file for analysis.