Malicious PDF — malware analysis report

Static analysis result for SHA-256 61eceff0dac4b8bd…

MALICIOUS

PDF

82.3 KB Created: 2021-03-26 16:59:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 5f8b2b5f73ac6e4595286ad1ee37c6d7 SHA-1: 949413d0b0e3fb1a49733eaa711f210256642a89 SHA-256: 61eceff0dac4b8bdf74b8365328ecad343152147c6e50ee199b0a62d5af17c51
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=brosur+kabel+supreme+pdf PDF link annotation
    • https://cdn.sqhk.co/girasufu/gcNIchd/32507755018.pdfIn PDF document text
    • https://nitevafatuva.weebly.com/uploads/1/3/4/8/134872456/455264.pdfIn PDF document text
    • https://miwevedadig.weebly.com/uploads/1/3/1/4/131437981/funalawa_novipotegar_xaruxa.pdfIn PDF document text
    • https://cdn.sqhk.co/gidenateg/adn1vhi/21333855240.pdfIn PDF document text
    • https://buboledimuxum.weebly.com/uploads/1/3/4/0/134017333/tedekovofexubitef.pdfIn PDF document text
    • https://bemozepe.weebly.com/uploads/1/3/0/7/130739793/90900326c0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zumomasugipeno/nomevawifufejejazaramemos.pdfIn PDF document text
    • https://s3.amazonaws.com/pexodugosa/zasizijin.pdfIn PDF document text
    • https://619c993e-e215-4b07-891b-88776ecab8c8.filesusr.com/ugd/1fce43_670ee572d8984a4bbf45523346db1141.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/ximupuv/85144328190.pdfIn PDF document text
    • https://s3.amazonaws.com/nonipesikiri/lexelo.pdfIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/ben_gurion_flight_arrivals_information.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f8f4b16-e6c2-437b-b632-33600ab329b2/16637317753.pdfIn PDF document text
    • https://d4508431-0eee-4913-ac2a-2ec907ed9b18.filesusr.com/ugd/12daa7_341ad227bd3c4d2d91267822434802c6.pdf?index=trueIn PDF document text
    • https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_1cdfca3f3bf041ac8677fbaf564e57c7.pdf?index=trueIn PDF document text
    • https://aefbb2f1-1cfc-4a48-aab2-d72547d84173.filesusr.com/ugd/2f3ac6_26c2e4fa2e8247aea0bbe4ca4c2eefb4.pdf?index=trueIn PDF document text
    • https://436240a4-ef10-404e-ad90-c5cab949c7af.filesusr.com/ugd/3fb742_f093a3f0d6e04efab0bd7f9aaebd473a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nitirew/derorosuzoliwo.pdfIn PDF document text
    • https://s3.amazonaws.com/wusone/buzemabobujo.pdfIn PDF document text
    • https://s3.amazonaws.com/bejenosugede/rule_of_st_benedict.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1886c6d7-8a96-4a70-82d9-7d14f49e4804/of_mice_and_men_movie_netflix.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE33 5088 bytes
SHA-256: c4412a0ea2a24ad779620434a0b1651d8205eb5a62dbb96cbf640207bd7e3c44
font_01_sfnt_off0000ef82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF82 12372 bytes
SHA-256: 29874f465b59695a7cefc049c7e7f5f91976eedb2dfcaa12c8d0f492c6791260
font_02_sfnt_off0001183d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1183D 16204 bytes
SHA-256: e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15
font_03_sfnt_off00012d6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D6B 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.