Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f928d4e7fc96fe4…

MALICIOUS

PDF

89.5 KB Created: 2021-05-04 19:03:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 9f2f0ae2d2a362cc0b44d7ce2e2064ae SHA-1: 2057270bd4d185cb5420ff39f16ba88573766ddf SHA-256: 5f928d4e7fc96fe48abb65b8323793edf677b9e457ff78a47179ed1fa4e60935
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by both ML classification and ClamAV, indicating a high likelihood of malicious intent. The heuristics reveal it contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, 'https://zajinet.ru/strik?utm_term=hoover+dual+power+max+carpet+washer+hose', is particularly suspicious and likely leads to a malicious site. No scripts were extracted, but the PDF structure itself is used to facilitate the malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=hoover+dual+power+max+carpet+washer+hose PDF link annotation
    • https://kizuwapeputatu.weebly.com/uploads/1/3/4/3/134375201/87932dc46.pdfIn PDF document text
    • https://jaketomerinojox.weebly.com/uploads/1/3/4/1/134109184/5c97fc8847e21bc.pdfIn PDF document text
    • http://golixudib.mypressonline.com/8258520390.pdfIn PDF document text
    • https://buwofapakudo.weebly.com/uploads/1/3/5/3/135316190/koguvarobefu_ririmoxuxixivus_woxajer_tagesidenarab.pdfIn PDF document text
    • https://varijiligedag.weebly.com/uploads/1/3/1/3/131383591/jasipobozox.pdfIn PDF document text
    • http://kavelizopepi.mywebcommunity.org/19868975371.pdfIn PDF document text
    • http://fafikup.scienceontheweb.net/filezetow.pdfIn PDF document text
    • https://sizasaligibi.weebly.com/uploads/1/3/4/5/134506534/nupinewozowabowa.pdfIn PDF document text
    • https://boleturem.weebly.com/uploads/1/3/4/3/134398498/xagejasisosuduja.pdfIn PDF document text
    • https://widobane.weebly.com/uploads/1/3/4/3/134340358/5752425.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://viniwowosur.onlinewebshop.net/shrimad_bhagwat_geeta_sanskrit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09c4532a-098c-4ded-877d-5874cf66691c/name_all_states_in_10_minutes.pdfIn PDF document text
    • https://s3.amazonaws.com/mukut/how_to_write_essay_for_college_application.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db634566-603f-469d-9d89-c8195c4a89b5/46934937527.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86dc5ec3-b61e-43b1-adac-fc9f0a7cec71/nasazalemikomeruli.pdfIn PDF document text
    • http://jalijoruki.atwebpages.com/79515936101.pdfIn PDF document text
    • https://s3.amazonaws.com/tazibabebamep/gilefiwomagojujunam.pdfIn PDF document text
    • https://s3.amazonaws.com/vidadaviwal/how_long_do_you_cook_a_hickory_smoked_spiral_ham.pdfIn PDF document text
    • https://s3.amazonaws.com/begijufadi/6074021954.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21b7e92c-503c-431b-9fd7-f691d4facb8a/16088148828.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8cbfac4-ac20-4d16-a5a8-48d27d64d071/26540973991.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bc54d3c-7908-488e-a4fb-f9d51ec425f1/mapovavijivugum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/396734fb-c3f7-48fd-88ff-edae88d9c641/the_brothers_menaechmus_theme.pdfIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/50480284188.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2075f390-9126-4c49-86dc-c6ac97d65208/75892216269.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5eeffe89-7bb2-4afb-8a23-d7fc186f5d03/focusrite_scarlett_2i2_for_mac.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010fb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FB3 5220 bytes
SHA-256: b688e822decfe89a9846729d2fb95f834f7a5f81aeed40607012dd0f4e327f74
font_01_sfnt_off0001218d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1218D 11772 bytes
SHA-256: 468c8bbf517d0aa39bbe2f0f02b2735e5c4fcfed379379afdfdfa92769f2ff21
font_02_sfnt_off000149ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149AB 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.