Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e0a98ad8d135d32…

MALICIOUS

PDF

126.2 KB Created: 2021-06-09 02:32:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 936a760ae1ba6b4de530832b401325cf SHA-1: bb6b9aab0c0319831be35ff172af7cd815a1e5fc SHA-256: 4e0a98ad8d135d32fe95d96633bb20a9d54402d93ec6660b58a77cd58b192d16
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=connect+italian+avanti+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454544/normal_602aff7b1319c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366978/normal_604e472840c52.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449615/normal_6012627048551.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374954/normal_6058e7f99b1a5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453732/normal_5ff9fc77909c3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387920/normal_602c720705884.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380680/normal_5fe43c96893b2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec19143f-fa32-4f91-82e2-310484f78bce/learn_to_speak_arabic_free.pdfIn PDF document text
    • http://kunozulig.pbworks.com/w/file/fetch/144725301/xujulasoxarudatagu.pdfIn PDF document text
    • http://veniwusuj.pbworks.com/f/how_to_store_raw_meat_in_freezer_without_plastic.pdfIn PDF document text
    • http://najapenoz.pbworks.com/f/borat_watch_online_123movies.pdfIn PDF document text
    • http://ronuzexem.pbworks.com/f/java_tutorial_oracle.pdfIn PDF document text
    • http://fuxotatizexu.pbworks.com/f/how_to_automatically_install_apps_on_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c297601d-c637-4a27-8c9f-bd4ff69e725b/comment_rendre_un_fichier_editable.pdfIn PDF document text
    • http://rimikupababo.pbworks.com/f/bosch_300_series_dishwasher_issues.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2494daaa-3486-42a1-9e1c-2d3e704dc1cf/31335429074.pdfIn PDF document text
    • http://kipizasuzeda.pbworks.com/w/file/fetch/144413793/ravpower_filehub_password_change.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aaf3cca5-e701-4efd-ad38-a14edf80f572/kadivixaxo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001b26b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B26B 4852 bytes
SHA-256: e88dae2c771bf532a00819d30d31e216c05afa32c3474e962ceba0d01d9bfcaf
font_01_sfnt_off0001c309.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C309 12708 bytes
SHA-256: c07bd0e4163179a8a712f708e288dc952f676e476d894ba4741e876e1e1e8593

Open this report in the interactive analyzer, or submit your own file for analysis.