Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c7f1544a98cd6b4…

MALICIOUS

PDF

74.3 KB Created: 2021-03-23 04:06:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 241985a6aa8c416382075461a190c58e SHA-1: b3d0e52bd400205f0026635eb04bd579d61157b0 SHA-256: 5c7f1544a98cd6b48b42b41d17a6c2fe256b0936ceea6a532b4415e686d41f3e
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many of which point to other PDFs, suggesting a link farm or SEO poisoning tactic. One prominent URL, 'https://golowaki.ru/award?keyword=alias+grace+pdf+completo+gratis', is presented as a lure for a 'free download'. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=alias+grace+pdf+completo+gratis PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4454971/normal_603889fc4a113.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485457/normal_5ffa69417b64c.pdfIn PDF document text
    • http://pelaberofusej.iblogger.org/15152571479.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481408/normal_60393814067cc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480389/normal_6005d8243ed93.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zaxigadanu.rf.gd/78107916560.pdfIn PDF document text
    • https://s3.amazonaws.com/fofeguj/7658088604.pdfIn PDF document text
    • https://a9750898-a066-404d-a796-54a2f5ad13bb.filesusr.com/ugd/60231a_ee144214f03145de95fd132692dbf59e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/midaguvimabof/xuputalomobobetoguripopa.pdfIn PDF document text
    • https://2ddedb0e-b7b0-41c9-a8bc-c018bd0e6e4c.filesusr.com/ugd/70094d_0784b090c2c2492ebd0229bd2958733c.pdf?index=trueIn PDF document text
    • https://4a1cfc67-5981-466d-a13b-75576fe7431f.filesusr.com/ugd/64e449_b9959b94bb704371966a8f6ae2f6066c.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vapelurowar/najuw.pdfIn PDF document text
    • https://s3.amazonaws.com/lixuduwonifa/whirlpool_washing_machine_filter_front_load.pdfIn PDF document text
    • https://d128792e-e0a8-46e0-98ed-b941f5da69b2.filesusr.com/ugd/b98abb_9344b52c2e174f69b39953022b9dd667.pdf?index=trueIn PDF document text
    • http://dobisesine.epizy.com/34366115468.pdfIn PDF document text
    • https://0d3c4653-ec4b-4b04-9c20-59e348ba858e.filesusr.com/ugd/62200f_3728344f32be44ec99258fcf3b9082db.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pusixa/cg_song_dj_syk.pdfIn PDF document text
    • https://s3.amazonaws.com/wukara/nogivodalamopixa.pdfIn PDF document text
    • https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_ec893fe538e04c7abb12b0996cc3cc8d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4F3 5464 bytes
SHA-256: 0203f514d3d95fbe2b1f590580d4047133d1ef2e119713fa771ad59ab892f648
font_01_sfnt_off0000f77a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF77A 10676 bytes
SHA-256: c13fa872a7f63bd37231e184150bfb7298af86971a1bf89447f5db93d8619a36

Open this report in the interactive analyzer, or submit your own file for analysis.