Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b2dff18c0b14e21…

MALICIOUS

PDF

81.0 KB Created: 2021-04-01 09:14:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: c6707438ef2c5d97e9b9170208241a24 SHA-1: 5a579da5da9eb6a63217c54a5434d63ce8280397 SHA-256: 4b2dff18c0b14e21d44687eea51942abac5e8c0f53568a20ca52233e8eb6ce80
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+do+i+fix+the+cl+code+on+my+lg+washer PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4413696/normal_603a0cf3c233a.pdfIn PDF document text
    • http://rejuxipo.iblogger.org/39413652935.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422163/normal_60257fe5ce451.pdfIn PDF document text
    • http://bixifofagowezi.22web.org/99039097013.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496816/normal_5fd03be64f607.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465151/normal_6032e5fb37dae.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368736/normal_5fe2a2187daab.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_3efd7c0058d64115953d5d5d5c07bf3a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juduk/sumaxilugoxogofonezukepu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/717e008c-413c-40aa-a14d-306a257c1e08/kaxazikasel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76535115-90fa-4be2-95e9-96f91c52fbc6/kenmore_elite_refrigerator_795_compressor.pdfIn PDF document text
    • http://zusirana.rf.gd/jafob.pdfIn PDF document text
    • https://7ffe38df-ef78-47a1-8632-a9c579db478a.filesusr.com/ugd/8ff694_d014969174f1459bb2188b45c573ea4f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/voxulija/analyzing_graphs_of_functions_and_relations_worksheet.pdfIn PDF document text
    • https://3633ae4e-9acc-45df-885e-1bfa1481cb44.filesusr.com/ugd/e73054_020d6b9ce46d4977915cd3893eddb3f1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lomuper/adding_and_subtracting_integers_worksheet_math_aids.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdf2a16c-b91a-49ae-a9f2-d33a058d3025/topavukotikosore.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ff5779d-8a5a-442d-980e-cec15e561f81/8020319337.pdfIn PDF document text
    • https://s3.amazonaws.com/timeziso/31837327121.pdfIn PDF document text
    • https://507d1b22-ea03-4061-a262-f79425337ca2.filesusr.com/ugd/a374b9_586b34fcee054a2280a8e951b069fda1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fivebo/lafidozumetevepusigubili.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/admission_form_aiou_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f047.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF047 5444 bytes
SHA-256: f6cfa3d3709a297d5dd00ccadf54d189f3346ddd707a50cd76f2c947ed072183
font_01_sfnt_off000102b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102B3 11128 bytes
SHA-256: cf094274a11e6aecd8bc06a8677de406886c8907486562e691255962db9eabe8
font_02_sfnt_off0001287d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1287D 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.