Malicious PDF — malware analysis report

Static analysis result for SHA-256 560028fa741aa54b…

MALICIOUS

PDF

75.8 KB Created: 2021-04-19 12:11:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 287d89b44593e9cff214555f44fbb1fd SHA-1: b2a813ac608dba322418dc7fd04f9f86dc00330b SHA-256: 560028fa741aa54b94021467cba5fe61e77f3cdb60459a3ec8cc5a3fac608f82
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=how+to+tie+a+bow+on+a+present+with+thick+ribbon PDF link annotation
    • https://cdn.sqhk.co/gixedomawa/9jfiiib/guess_men_s_t_shirt_urban_outfitters.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411246/normal_60249a5783333.pdfIn PDF document text
    • https://cdn.sqhk.co/wexapitode/atqjWJM/mortgage_note_payable_journal_entry.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480743/normal_6015109809abe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387233/normal_60461b1f52456.pdfIn PDF document text
    • http://kakafeg.scienceontheweb.net/vibimedosonatetabuj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375517/normal_6068bedb6ec20.pdfIn PDF document text
    • https://cdn.sqhk.co/ruzemesafe/mtol4ia/forest_panda_run.pdfIn PDF document text
    • http://bagawixaj.mywebcommunity.org/auditoria_informatica_antonio_echenique.pdfIn PDF document text
    • http://xuxetosufuzo.getenjoyment.net/68661833655.pdfIn PDF document text
    • https://cdn.sqhk.co/nebuneduzib/bhajcgg/32413767193.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/viromibukoleliw/uncharted_4_unstoppable_trophy_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/rimejiguvif/new_english_albums_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/jizubisetebof/88728274498.pdfIn PDF document text
    • https://s3.amazonaws.com/wofaxil/coffee_recipe_in_urdu.pdfIn PDF document text
    • https://f499a9ea-5579-4d3c-a180-ba191067f9b7.filesusr.com/ugd/34ec99_49c95eeeb06e4a6f948fb1563d7adbf7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pubopelej/21315204668.pdfIn PDF document text
    • https://s3.amazonaws.com/veledabejufi/gisojasefuseduduguwekek.pdfIn PDF document text
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_7abff313868d44a6bf61b30d19c4a314.pdf?index=trueIn PDF document text
    • http://vekamodadon.onlinewebshop.net/simple_present_tense_esl_worksheet.pdfIn PDF document text
    • https://1c514d3f-4aca-4c14-a2cc-94ef866bc6c7.filesusr.com/ugd/860217_bc493a8c1ed048228082c9cb51cd5953.pdf?index=trueIn PDF document text
    • https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_e71eb6430a9e40dc934a4e07d1eb70f1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xupimaral/sazulile.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA20 5244 bytes
SHA-256: 3dc5cd65f0970eca9fa736f12aa9ec112a29eabe90c4f6e5c277d41b1e9ad304
font_01_sfnt_off0000fbfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBFA 10504 bytes
SHA-256: 0be8d3e82809d482c049835256ee27cffec4785298d7925e896436e817626ea9

Open this report in the interactive analyzer, or submit your own file for analysis.