Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e5696f7d4a48d46…

MALICIOUS

PDF

109.0 KB Created: 2021-05-24 06:26:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 93a8f0ba03bbf5810f1eb9515b978d5d SHA-1: 13f096be0fed45969dedc6c0d6f8660659461b50 SHA-256: 4e5696f7d4a48d46ddbc5559b08d50f658c2b1bc6ced751383610880d8325a46
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic indicating a link farm with numerous external PDF links, and one of the embedded URLs points to a domain associated with phishing. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or trojan distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a social engineering attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=pokemon+fire+red+omega+cheats+download PDF link annotation
    • https://tajafakedebufu.weebly.com/uploads/1/3/1/4/131438499/638de955.pdfIn PDF document text
    • https://jokineviraxara.weebly.com/uploads/1/3/4/2/134265776/senunip-pavokotuviguvix-dinitiwowo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d94eedda-333c-4766-8dfb-62f35944ee05/kozudu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d356294f-8152-4ef1-9634-061c337b73bb/how_do_i_charge_my_jlab_go_air_earbuds.pdfIn PDF document text
    • https://s3.amazonaws.com/liwafo/formation_continue_aefe_madagascar.pdfIn PDF document text
    • https://s3.amazonaws.com/bejenosugede/sujezoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d78349a8-1299-4ffa-b27b-c3b7368cd61f/75914266926.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/jebajebikine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf1ab2bc-9b58-4fa0-962a-17948d93b3b5/ruxuwobokadape.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41387bae-a81f-424c-9a4e-c66927d00c4a/attack_on_titan_season_2_english_dub_funimation.pdfIn PDF document text
    • https://s3.amazonaws.com/liwafo/96323215240.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd5c3ea1-da63-47ad-92a1-9e5f5dd03ac6/data_structures_in_c_geeksforgeeks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6b48e04-5c72-4b0e-ac4f-b88698a70587/checklist_for_new_home_final_inspections.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6dcd4e3-eb60-4c18-af8f-0c37bd48ee79/xavatudulitununopitotife.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c6e0925-c40c-47f3-9cac-181875b53a4e/vipazojitobaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e18df108-96c7-401f-9c6f-a6bc361ae141/mujatomifexixo.pdfIn PDF document text
    • https://s3.amazonaws.com/pegebunov/59010400666.pdfIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/samsung_series_7_smart_tv_apps.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30982835-1bf3-4a3a-8989-170ed386bdac/kuridukel.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014b25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B25 5592 bytes
SHA-256: cdde8decacb8d486443691aecf9487d73afe672a51f4ec78f64ff2b27168e522
font_01_sfnt_off00015e0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E0F 1936 bytes
SHA-256: 84daf345e21b08075a6e329eeacb0a13a0447ddcc3efc64e98a9a4ab9c6a9d9d
font_02_sfnt_off00016750.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16750 12588 bytes
SHA-256: da8136ffa140663428283c58f1b7bdb1a0a486fd5ea239ac18c480689091eaaf
font_03_sfnt_off00019038.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19038 16368 bytes
SHA-256: 339bd93d92cd73c5ef44b332862b6b76f909040f0e7ff8bf1d03a2f4380e26bb

Open this report in the interactive analyzer, or submit your own file for analysis.