Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f033191b410d321…

MALICIOUS

PDF

76.3 KB Created: 2021-03-04 13:16:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 25135d31b2b5230db7e0dbbea2804427 SHA-1: 927c5c8152b8aff6039e93b04117fc7e821a94f9 SHA-256: 5f033191b410d321b7d0caddf575c4d5942ed2a495c4a57b739689d8a4d6f41e
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which point to disposable hosting and are part of a link farm, indicating a phishing or scam attempt. The primary URL leads to a site that appears to be a lure for a product, likely a phishing page. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8823

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=oral-b+pro+1000+crossaction+electric+toothbrush+green+powered+by+braun PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4379474/normal_5fd2d77f7b5b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444850/normal_603f08cb26ae3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426941/normal_60135e8c23202.pdfIn PDF document text
    • http://dalkomis.website/40600533471ejdsp.pdfIn PDF document text
    • http://walletelectrum.buzz/buwifovovivaxaxuvonagsngl.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401732/normal_5fe6529d37f45.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462379/normal_600fce2cd6767.pdfIn PDF document text
    • http://drilltech.info/havering_sixth_form_a_level_courses8er5y.pdfIn PDF document text
    • https://cdn.sqhk.co/rogudokives/SjfI8jd/bejitutulata.pdfIn PDF document text
    • https://cdn.sqhk.co/jijasitov/evZ3Vp5/xuxikedi.pdfIn PDF document text
    • https://cdn.sqhk.co/lelogivotosu/eXpugc1/27833595485.pdfIn PDF document text
    • http://secret-empire.ru/recording_app_download_karent34uy.pdfIn PDF document text
    • https://cdn.sqhk.co/pulisamog/8uHghp9/fosuridirefixakofelese.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mibofive.epizy.com/tibesimux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cca7021-6522-4107-af9c-5bbf9f228833/chaos_theory_butterfly_effect_tattoo.pdfIn PDF document text
    • http://poramukuwulaji.epizy.com/birthday_pic_gif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31f22fff-e275-4d24-a231-4d64478d3cfb/88958010847.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e49655c0-3947-4766-851c-414d3e49cd39/speed_queen_washer_coin_drop_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80775477-9ce7-4d68-9a24-3cf4faed048d/favivuvurutepomefaxoranas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad38cc2f-a824-4dad-baa0-8e031503013e/what_does_subjective_frame_in_art_mean.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D39 5920 bytes
SHA-256: e66c6f89b05c063b8e4eb53e2c6f102755cd722a646259cb6720b8be91599b13

Open this report in the interactive analyzer, or submit your own file for analysis.