Malicious PDF — malware analysis report

Static analysis result for SHA-256 5265f761eee830b4…

MALICIOUS

PDF

66.6 KB Created: 2021-03-13 18:08:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: b192eb5d87afe9208f70dfdcdcaf05ef SHA-1: 93c0ce8fcf82b51fbebd618f187b614e4f52f5aa SHA-256: 5265f761eee830b44f97d8232ddad348ad3bbc5820f70623c5a1a8e133ce3f47
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to disposable domains, suggesting a link farm or phishing operation. The ClamAV detection and ML classifier further indicate malicious intent. The document body, though truncated, contains a search query related to outboard motors, which is likely a lure to disguise the malicious nature of the links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+adjust+idle+on+40+hp+evinrude+outboard PDF link annotation
    • http://trycabinets.xyz/why_is_my_hp_officejet_3830_printing_blank_pages5ygh2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420597/normal_602d29ec51885.pdfIn PDF document text
    • http://top-agent.ru/ruud_silhouette_gas_furnace_filter_sizevqq4f.pdfIn PDF document text
    • https://lilafigofuku.weebly.com/uploads/1/3/1/3/131398347/3811900.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4530846/normal_602cac3ab887c.pdfIn PDF document text
    • https://fatuzolawodazu.weebly.com/uploads/1/3/4/7/134730183/1496315.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457592/normal_602730bc37390.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475564/normal_5fd63dac97f13.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371553/normal_5ff9e7cbce822.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d19e06a-a592-4e52-94fc-f409b9258315/29742251860.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9495b6b4-931d-4378-90e4-8103cf320a15/25906770553.pdfIn PDF document text
    • https://8964868a-aef6-4da0-9a9b-29de7c28e0c5.filesusr.com/ugd/b910ae_98fe646d815543af824f4948ffa97f33.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/93852ccd-a452-4385-b030-fe166e8a7ca0/mukesedasezaxo.pdfIn PDF document text
    • https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_172c62615c194ad4ba4bda26d007f160.pdf?index=trueIn PDF document text
    • https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_80b9179413d84504970ff6a816993bfc.pdf?index=trueIn PDF document text
    • https://e85625e8-91d5-48c2-95a4-67b7b95d5b39.filesusr.com/ugd/b97a97_c807c0573c114ca3b79e517de9f5160c.pdf?index=trueIn PDF document text
    • https://eb62986f-0112-409a-9ebe-777412bc5c19.filesusr.com/ugd/26938b_3901d2599933498cbee8f959724a41e3.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c5b631c-8fa2-4e9d-bcc6-75a4b001493b/27455136202.pdfIn PDF document text
    • https://c6506652-bf5e-4f52-be36-03dbfaede22c.filesusr.com/ugd/f74919_3e77f7e7100143cb92c0d5c484c005df.pdf?index=trueIn PDF document text
    • https://07bd7893-a6ec-44d5-90fe-c719e602c0bd.filesusr.com/ugd/aafaff_75f9f6e9ba854b6c8ff96128462586d6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/21aa23fb-0271-4dd7-9b0c-cb9416be9fdf/stephen_hawking_books_amazon.pdfIn PDF document text
    • https://8eb0ff2f-1b5f-41fb-a82b-bf279dc7f43e.filesusr.com/ugd/868f76_9894ed77958c4ad587fe77d1833d177f.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE2D 5604 bytes
SHA-256: b1563d4561086a27958edf4d6372101bd962c7e1ff5b9214c5ff034b8f2d6a44

Open this report in the interactive analyzer, or submit your own file for analysis.