Malicious PDF — malware analysis report

Static analysis result for SHA-256 510e376a8d465578…

MALICIOUS

PDF

96.7 KB Created: 2020-11-18 10:57:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: f7fcc16ab0159840cb4e7e2aaa0988eb SHA-1: 2fb3c0df441ea4220ae6451d129476ce1b067602 SHA-256: 510e376a8d465578d4eaf5c5b95b17ba889007320f8a75443fcab9c31129ed85
214 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9938

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=sword+art+online+volume+21 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4410013/normal_5f958fa0a7652.pdfIn PDF document text
    • https://dowezepuxaku.weebly.com/uploads/1/3/4/4/134463959/7559956.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/potofaw/10094108550.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27f4e9d3-ef42-42d7-943c-720b9bf8eda7/95841936924.pdfIn PDF document text
    • https://s3.amazonaws.com/davubewu/rosefigarufasisaja.pdfIn PDF document text
    • https://s3.amazonaws.com/sazixipame/petamegerorelelaf.pdfIn PDF document text
    • https://s3.amazonaws.com/bivanud/petrografi_batuan_piroklastik.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/free_maths_worksheets_for_toddlers.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/waiting_for_godot_text_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f718.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF718 22592 bytes
SHA-256: 5c72180cbe86ddb168a9279cc8b9ac77d47780038a81031eaa0788f6ab074b04
font_01_sfnt_off00013e00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E00 5232 bytes
SHA-256: ccc3fceb50a9d6fa40e2e307f07d657f01c12137d467ba40a4d69664136898d5
font_02_sfnt_off00014fd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14FD0 11868 bytes
SHA-256: d7f0a35470d5f65ee3ffadfecd238ecf54178526782bd5b7a95f8d74937c9a1a

Open this report in the interactive analyzer, or submit your own file for analysis.