Malicious PDF — malware analysis report

Static analysis result for SHA-256 65586b4a33cdbcf3…

MALICIOUS

PDF

104.8 KB Created: 2021-05-27 22:58:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 932b6660fc3b786187c936792875e3d4 SHA-1: 10f315a90d7614c6d6078293f259f4337160f1d7 SHA-256: 65586b4a33cdbcf33cb6a5fdbdf16242ceb8298939e135907fa7a4a33f7164ff
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting services, suggesting a link farm or SEO manipulation scheme. The presence of multiple unknown URLs and the PDF_SEO_LINK_FARM heuristic strongly support this attack pattern. No scripts were extracted, but the PDF structure itself is used to host these malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/123?utm_term=wa+alaikum+salam+short+form PDF link annotation
    • https://jugizefabugej.weebly.com/uploads/1/3/4/3/134377355/tozasirozim.pdfIn PDF document text
    • https://dunifavopugi.weebly.com/uploads/1/3/5/3/135312205/1094187.pdfIn PDF document text
    • https://toxofeleziwogiz.weebly.com/uploads/1/3/1/4/131406173/7093d7e307a.pdfIn PDF document text
    • https://lubumona.weebly.com/uploads/1/3/4/6/134648672/9887492.pdfIn PDF document text
    • https://galesarenad.weebly.com/uploads/1/3/4/3/134380117/6d269ef.pdfIn PDF document text
    • https://gavuzolarot.weebly.com/uploads/1/3/4/4/134458525/2493535.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386089/normal_60470902bc3f8.pdfIn PDF document text
    • https://geripipo.weebly.com/uploads/1/3/4/3/134371036/2104237.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407313/normal_606a8cf61786e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ba0c814-d8c5-4a61-949a-379b32c2d9be/mastering_vmware_vsphere_6.7_nick_marshall_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68b53fda-744c-4308-a45b-af00fafad1ee/91196232169.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2d8a91b-cefc-47c2-91b3-61ebe931d606/38458880198.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c3a90c8-e517-4a30-8eee-ea831efd8538/acorde_mi_bemol_7_piano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a86147b4-6783-40d6-859d-679d68038c10/59596884857.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fde4a68-6a54-4c02-b610-3ebd36018d18/do_honda_generators_come_with_oil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e7d04a3-0ea6-4acc-9979-b3ec86a1a34a/80973321465.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c60fa46c-5086-4ec0-ad4f-404f682cd85c/blank_bubble_sheet_printable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1fa13cf-8628-4836-94bb-d707141e46c6/56111580341.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9691f4da-38d9-470b-8a18-0148ae2ee102/91893053852.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5bdeded-cdaa-4a08-a4f4-43d1b826c6a2/best_broadway_musical_songs_to_dance_to.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3c4e764-e42a-43c3-88a0-43fab79f5748/pretty_little_liars_season_4_episode_13_dailymotion.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00016375.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16375 21552 bytes
SHA-256: 7d63e408d9902103d7bfd9709f1170d8641fb79ed6673999e81b574f3e4954e7
font_00_sfnt_off0000f6b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6B4 8084 bytes
SHA-256: d7a71e3d59670673a1060783973dc5c0e05bb7e40e0e7fd35738e160463bede2
font_01_sfnt_off0001122c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1122C 5084 bytes
SHA-256: 58c6a54a7d119efbbfd811d065ab242b27f30827555565c85e85cd798e5a862a
font_02_sfnt_off00012356.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12356 4980 bytes
SHA-256: 9aae09fe14517c42a3addc202cf3a374b6077e960c18d2dfffbd4c8486b8829f
font_03_sfnt_off0001337e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1337E 16052 bytes
SHA-256: dd1fc8caa75b3950e500c4803b36543940456948ef084d4df826335f69886540
font_05_sfnt_off0001878f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1878F 3232 bytes
SHA-256: 702d6d44518c3b5662704ff31d4f322cf90b10fdcdc6fe9e587d73ebd4ea285f

Open this report in the interactive analyzer, or submit your own file for analysis.