Malicious PDF — malware analysis report

Static analysis result for SHA-256 5abc423ae9f22f82…

MALICIOUS

PDF

80.5 KB Created: 2021-04-05 20:47:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 711eeba401b9010848263b1144ceadd0 SHA-1: cc9e8f3438cb106f630952ac41c479f5dea7fc93 SHA-256: 5abc423ae9f22f829fa6ff764bc5d11bb81dd51d3d92f66a352240248f11c36b
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=better+than+before+audiobook+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4405642/normal_60586817658ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393638/normal_5fd131072b502.pdfIn PDF document text
    • http://xazixovabifin.medianewsonline.com/rurewuguvotorevu.pdfIn PDF document text
    • http://timinome.getenjoyment.net/bioassay_of_serotonin.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366302/normal_604ba414d6a12.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449965/normal_604730162af58.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366381/normal_604422c046add.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bepukuba/how_to_find_someones_burial_plot_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/what_are_positive_and_negative_sentences.pdfIn PDF document text
    • https://s3.amazonaws.com/loranoduzuja/dd_5e_adventures_free.pdfIn PDF document text
    • https://s3.amazonaws.com/sirilagewuga/penutimokasabisow.pdfIn PDF document text
    • https://s3.amazonaws.com/duzexefemosaxe/chemical_bonding_exercises.pdfIn PDF document text
    • https://71da2aa5-51c3-4f2c-ab18-08bbbad20131.filesusr.com/ugd/d216cb_d4a408f91813484188df27c4bf4809b4.pdf?index=trueIn PDF document text
    • http://xaredekol.epizy.com/physics_laboratory_apparatus_and_their_uses_with_pictures.pdfIn PDF document text
    • http://nokefibazapowem.rf.gd/ace_academy_notes_for_gate_ece.pdfIn PDF document text
    • http://womunek.rf.gd/ghouls_osrs_slayer_guide.pdfIn PDF document text
    • http://lexituvom.epizy.com/44177040095.pdfIn PDF document text
    • https://1ee34b3e-bfcb-4e25-b227-79ffd44eef10.filesusr.com/ugd/9d5096_4b1b10daaa4c4874a4ba760c11b0e39a.pdf?index=trueIn PDF document text
    • https://8459f3b7-b2e6-4b58-af31-5f29adf293b7.filesusr.com/ugd/a68450_305535423d4e4a15bde0f3888a7d0993.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tamovagag/britax_car_seat_front_facing.pdfIn PDF document text
    • https://d190c387-1498-4382-a59e-98d1a0a9794c.filesusr.com/ugd/a91264_a821164078724ce984c33eaaed363987.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xotomisen/41788413205.pdfIn PDF document text
    • https://s3.amazonaws.com/bidurudilidujug/storm_in_a_teacup_book.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB36 5036 bytes
SHA-256: 03bc4445989c74b0d56ae1676b0acaa6fbf1fba0d105ccf31675bfeb2e1bf61a
font_01_sfnt_off00010c51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C51 12016 bytes
SHA-256: 1ad88823de75e8279e00769caf6fbe7e7a602b9b5b9716ed6d703ed4998faf80

Open this report in the interactive analyzer, or submit your own file for analysis.