Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a269113d7e873d0…

MALICIOUS

PDF

79.1 KB Created: 2021-03-07 09:19:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 78caf8b060acb80983ed8f8b587e1fdc SHA-1: 8ef1aff0060e644411e1abff8d92302030dd47a9 SHA-256: 5a269113d7e873d0ae3d9b4b1233efa13df9387f8cd77e220f28e30fc8e224c8
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8187

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=dragon+age+asunder+pdf+free+download PDF link annotation
    • http://vumajuzatijerak.getenjoyment.net/72537842985.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467561/normal_5fce49d874321.pdfIn PDF document text
    • https://julasunanuk.weebly.com/uploads/1/3/4/3/134308365/f18429.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453326/normal_6042190d5f060.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414161/normal_5feb6e4b63a96.pdfIn PDF document text
    • https://luwojasog.weebly.com/uploads/1/3/1/3/131380471/tunijimuz-werimagojamoza-vifif-diritiz.pdfIn PDF document text
    • https://cdn.sqhk.co/nadudegimew/iiZIHhf/gekogiwizimowaxi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474759/normal_5fe9e012201fa.pdfIn PDF document text
    • https://cdn.sqhk.co/pelebitebi/3MKLgiH/botal_bhar_daru_chadi_dj_mp3_song_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464873/normal_60411db893672.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366397/normal_5fdf6e061efce.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383467/normal_5fe075ee9677b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382003/normal_602eb6ed2c5a3.pdfIn PDF document text
    • https://dufofumiwiz.weebly.com/uploads/1/3/5/3/135309849/xitapomaloj-siseva.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://doriponesarom.myartsonline.com/fewepabojagewaforitivod.pdfIn PDF document text
    • http://lipabarud.atwebpages.com/boat_knot_tying_guide.pdfIn PDF document text
    • http://kipazafar.atwebpages.com/441126462.pdfIn PDF document text
    • https://s3.amazonaws.com/jiwisigetizoxif/32923731751.pdfIn PDF document text
    • https://s3.amazonaws.com/tanapilamaxi/bigotry_adjective_form.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EAD 5300 bytes
SHA-256: 6bcfc0001975f0608f395ae4a956af783635faf7ba00b09277a1eac5ab6dc667

Open this report in the interactive analyzer, or submit your own file for analysis.