Malicious PDF — malware analysis report

Static analysis result for SHA-256 666c60b1cf6519dc…

MALICIOUS

PDF

89.6 KB Created: 2021-05-20 10:23:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 1db91fd6d20f052c074d64d66c9f16c9 SHA-1: dde508f80101d5351b6a0610ab0637d6306e87e2 SHA-256: 666c60b1cf6519dcc839f0263041663c0beddc1c655ce6ada18c17def708f8ff
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=agriculture+biologique+tunisie+pdf PDF link annotation
    • https://xutezanepone.weebly.com/uploads/1/3/3/9/133999331/5832933.pdfIn PDF document text
    • https://gomafaned.weebly.com/uploads/1/3/5/2/135296522/7974095.pdfIn PDF document text
    • https://lekinimogasujif.weebly.com/uploads/1/3/0/7/130739945/2eb9646dc4.pdfIn PDF document text
    • https://bugitepekasi.weebly.com/uploads/1/3/4/6/134669175/5343f2ce37839d6.pdfIn PDF document text
    • https://posolefuriw.weebly.com/uploads/1/3/4/3/134374222/2226257.pdfIn PDF document text
    • https://varavedonenen.weebly.com/uploads/1/3/4/3/134316352/6477819.pdfIn PDF document text
    • https://lekozeva.weebly.com/uploads/1/3/5/9/135964777/51fbfa50c0ad0.pdfIn PDF document text
    • https://minaraxu.weebly.com/uploads/1/3/4/7/134765114/wimurerepiv_podipex_kisunejipozit.pdfIn PDF document text
    • https://marejeloxivel.weebly.com/uploads/1/3/4/7/134709382/punasotokipafuz.pdfIn PDF document text
    • https://vepodiruwa.weebly.com/uploads/1/3/4/3/134374194/3dc432.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/f4d15f25-10ae-415e-9719-0d84b327666a/kjv_study_bible_app.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a84487a7-6fbd-4676-a65d-0d852e47c5a3/2907068058.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd61a154-45a6-4016-b730-aeb5947fc9d6/who_are_the_3_main_characters_in_harry_potter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2bf5045-19b0-4c88-b972-5e4cd32b9123/how_to_play_chickenfoot_with_double_12_dominoes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5f089ae-a3e1-4b34-b765-4f55f323bc15/zivagutefuxizurod.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8b13f8c-690b-4fcd-96a1-0a7387dfd106/razer_blackwidow_ultimate_2014_switch_type.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/563c729b-9853-4dff-bf99-b1442d9a21c3/when_did_final_fantasy_7_remake_come_out.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/306b828c-2f58-4de1-b7dc-0031cfb79246/what_is_the_book_dog_man_about.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abb76bf1-8996-4212-a948-36f6c80bbf1f/2015_fillable_1099_misc_form_2017_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000126f0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x126F0 20920 bytes
SHA-256: d2f0af551b878aee6a91d0e289d9f70d8841a4c98eddd0e4bfd96bba6ce8894a
font_00_sfnt_off0000ef15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF15 5248 bytes
SHA-256: aed846e4b405f86af683415a38fea3237d3f8c6b52afce29f2524291df9d941c
font_01_sfnt_off000100e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100E8 11712 bytes
SHA-256: c3543d5ae47bb8b44ac8c3a3f00cec26507c9dcde2f92089bc729d890cf12d2c
font_03_sfnt_off00014abf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14ABF 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.