Malicious PDF — malware analysis report

Static analysis result for SHA-256 638df21d8f642887…

MALICIOUS

PDF

78.0 KB Created: 2021-04-07 21:02:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 836f1ba5307fe9635f7ee004ea20cd24 SHA-1: 5409d6eadfa3be23cf9386f0ecfcac710b5c96ba SHA-256: 638df21d8f6428877f05fc190d9238911ef136de27755c4a4720df717dd33a23
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=ultimate+frisbee+worksheet PDF link annotation
    • http://roflan.site/bajeroik7h.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447662/normal_605b6fd282449.pdfIn PDF document text
    • https://cdn.sqhk.co/dewozoju/iO7ueJg/photo_editor_background_change_free_online.pdfIn PDF document text
    • https://cdn.sqhk.co/genizataxom/jgje4xk/lifeafter_update_september_2020.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426942/normal_600e98b54fdef.pdfIn PDF document text
    • https://cdn.sqhk.co/tosilura/iaPxhie/download_stickman_warriors_online_mod_apk.pdfIn PDF document text
    • http://onlineeshop24.xyz/star_wars_rogue_one_film_locationsi5tct.pdfIn PDF document text
    • https://cdn.sqhk.co/xoraxuvonaf/cDGpijW/nawibix.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378853/normal_5fd5fddc29e59.pdfIn PDF document text
    • http://plsale.pro/sagozijepotumedovigaxns1u2.pdfIn PDF document text
    • http://znasila.ru/amazing_grace_my_chains_are_gone_lyrics_video7p5ku.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494160/normal_5fe700368b6b6.pdfIn PDF document text
    • https://cdn.sqhk.co/jadepibake/igCDhgN/bayalata_information_in_kannada_language.pdfIn PDF document text
    • https://cdn.sqhk.co/nifijagik/hcPlhaB/epl_top_scorers_2020_21_season.pdfIn PDF document text
    • https://cdn.sqhk.co/ximosufi/ibPiegg/flyer_templates_free_powerpoint.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490371/normal_60698a962bd69.pdfIn PDF document text
    • https://cdn.sqhk.co/wewisadavoj/bhae2ig/46355541540.pdfIn PDF document text
    • http://jsexj.fun/garmin_oregon_650_vs_650tgcp25.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a80475d-ee0a-4b4e-ad2f-7d5315c97442/dark_souls_4_kings_walkthrough.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b998f1b7-9159-434e-a5ed-e4a26062be69/what_is_the_setting_in_the_veldt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d20d0ce-f2f1-41d2-b9bb-4395b9a77599/shark_rotator_powered_lift_away_with_duoclean_nv800.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60397d14-4490-4a61-a30a-d93f05579f9a/25181661341.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d72be8b-087e-4dc4-907a-983d0ebb00ca/64122242126.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE723 5296 bytes
SHA-256: 0428fc8338a6f1ef40995e7d777214dd7f6ea5945d4abe5014d594499ffe8d1e
font_01_sfnt_off0000f907.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF907 2304 bytes
SHA-256: 9f387c4b0d88270485e0059e59625ced4a6020807654079e289cce510ef81115
font_02_sfnt_off000102f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102F7 11284 bytes
SHA-256: 8a0be5aa457cda54a102403fa48f8e0ee98307a97bc25719a8b40a7a36ed15b8

Open this report in the interactive analyzer, or submit your own file for analysis.