Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b851460324d8ca9…

MALICIOUS

PDF

80.4 KB Created: 2021-03-06 13:49:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 0695dd1af3828e5f6094c5b82db41547 SHA-1: 8759e93741dcc819c775d76a35e5c451eb51ff43 SHA-256: 4b851460324d8ca9f8ce88aa985ed0938da5ee75af73272e2aee9959c132ded2
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6575

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=how+to+master+ccna+r%2526s+pdf PDF link annotation
    • http://dajexori.mypressonline.com/what_does_chance_mean.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487007/normal_5fd05d87000e8.pdfIn PDF document text
    • http://pevazaw.mypressonline.com/riluxodupesadosovev.pdfIn PDF document text
    • http://forovasax.medianewsonline.com/99754505387.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500001/normal_60358c55a6b68.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4498842/normal_603f3c2a109ac.pdfIn PDF document text
    • http://nusowutevu.getenjoyment.net/the_40_rules_of_love_summary.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4498702/normal_603aa40a86527.pdfIn PDF document text
    • http://nuwojukow.mygamesonline.org/how_predictive_analytics_works.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383805/normal_603f539b708c0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nagudo/99th_amendment_act_of_indian_constitution.pdfIn PDF document text
    • http://wawutanow.epizy.com/liturilino.pdfIn PDF document text
    • https://s3.amazonaws.com/tokatefozude/23795082227.pdfIn PDF document text
    • https://s3.amazonaws.com/limepusotanal/merkury_innovations_apollo_earbuds_review.pdfIn PDF document text
    • https://s3.amazonaws.com/fonazuzixagizir/2006_honda_civic_hybrid_power_steering_problems.pdfIn PDF document text
    • http://xigonix.rf.gd/reassess_your_chess_workbook.pdfIn PDF document text
    • https://s3.amazonaws.com/rabewiruzitewa/how_to_setup_dcs-930l_wireless.pdfIn PDF document text
    • https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_177ca93617044346aa3f675f7a415006.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/varoximu/aviate_launcher_free.pdfIn PDF document text
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_e7eabe0c4f4e439fa9131ec24ff2addb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/seriposuj/8311634768.pdfIn PDF document text
    • https://d128792e-e0a8-46e0-98ed-b941f5da69b2.filesusr.com/ugd/b98abb_86a5ce7143ea4999b8e883fa7e21f6af.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B48 4704 bytes
SHA-256: c2ae4299ad5db0cf38c7ebab77bb024b12833977e3d01ad630c765d8330c6695
font_01_sfnt_off00011b24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B24 11572 bytes
SHA-256: a75a8e112dfe7741a7ceb7aaa97d9986fc95cf86877af8f417a531e29aa15e7f

Open this report in the interactive analyzer, or submit your own file for analysis.