Malicious PDF — malware analysis report

Static analysis result for SHA-256 51eeafe66a69d59f…

MALICIOUS

PDF

75.0 KB Created: 2021-03-15 05:40:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 7fac83c9148d84606795508f9e5b6c2c SHA-1: 7ed2f6a71b4e70ac819b6c885e7f251d4379c712 SHA-256: 51eeafe66a69d59f76b1938961b01c6d93cafc2a77d946c4fb8a95d8caa509b8
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9690

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=attestation+d+honneur+d+h%25C3%25A9bergement+pdf PDF link annotation
    • https://todilotifobaw.weebly.com/uploads/1/3/2/7/132712516/4595495.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448538/normal_6035c9ab268c1.pdfIn PDF document text
    • https://cdn.sqhk.co/befulirawid/wFjbISd/subway_train_simulator_2.pdfIn PDF document text
    • http://zizodoroluxonaf.sportsontheweb.net/unravel_me_lyrics_tokyo_ghoul.pdfIn PDF document text
    • http://kewatupu.scienceontheweb.net/what_your_name_in_arabic.pdfIn PDF document text
    • https://livaruzurakit.weebly.com/uploads/1/3/4/4/134432061/8f93d1fb4e7c5.pdfIn PDF document text
    • http://bexixibeguben.sportsontheweb.net/46956818675.pdfIn PDF document text
    • https://vexibalob.weebly.com/uploads/1/3/4/8/134896466/tuwanozumudesob-dobowefupo-kodopena-namijivaziv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412573/normal_604ecba24b98a.pdfIn PDF document text
    • https://zazozoke.weebly.com/uploads/1/3/0/7/130776388/8b2310.pdfIn PDF document text
    • http://xuxetosufuzo.getenjoyment.net/msoe_nursing_acceptance_rate.pdfIn PDF document text
    • http://zokazurimila.mygamesonline.org/minn_kota_power_drive_ipilot_head.pdfIn PDF document text
    • http://peromopativej.mypressonline.com/how_to_turn_a_delta_crib_into_a_toddler_bed.pdfIn PDF document text
    • http://mekujoviwe.mypressonline.com/the_lost_ways_book.pdfIn PDF document text
    • https://warevinigipa.weebly.com/uploads/1/3/4/8/134898994/3dc981.pdfIn PDF document text
    • https://cdn.sqhk.co/gozolijitow/ii5Nwgc/exorcist_cast_season_2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369516/normal_5fceccdec07b2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lanorolowu/betpark_tv_apk_indir.pdfIn PDF document text
    • https://s3.amazonaws.com/likerajatob/xumidafiwilara.pdfIn PDF document text
    • https://s3.amazonaws.com/safago/cheerleader_lyrics_by_pentatonix.pdfIn PDF document text
    • http://zuvuzevo.atwebpages.com/momemadeditev.pdfIn PDF document text
    • https://s3.amazonaws.com/kalanejaxutilif/counter_strike_source_mods_zombie_free.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9A0 5692 bytes
SHA-256: 38a89aa81870429831e56017ee6cda26a654f6ce03493b84eef3c247f978c69a
font_01_sfnt_off00010c8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C8D 12532 bytes
SHA-256: b5ab58d2cdc1eb7a08d1936ef1e1c27cb313b1f270e5a8dac9f6570fce3aa66b

Open this report in the interactive analyzer, or submit your own file for analysis.