Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c6a0c09388c64ea…

MALICIOUS

PDF

84.3 KB Created: 2021-05-30 21:10:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 4fa7e4d1361bf9e81f236b1acd7f1c27 SHA-1: 1deef9bee29a370aa7462a96eceeabe1acdd8e01 SHA-256: 6c6a0c09388c64eab01d3e49835d00fa784ab37bfa269db15fb5fed4c1940c0e
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=fifth+harmony+songs++2017 PDF link annotation
    • https://medijomozu.weebly.com/uploads/1/3/0/7/130775841/rakawopeze-kewusabu.pdfIn PDF document text
    • https://radutarogo.weebly.com/uploads/1/3/4/3/134379411/gozogegenolirus.pdfIn PDF document text
    • https://basisini.weebly.com/uploads/1/3/4/7/134775363/ritugukal-zusinepu-febamutofit-zexixa.pdfIn PDF document text
    • https://lugelobixo.weebly.com/uploads/1/3/6/0/136095506/a9a01d988d0.pdfIn PDF document text
    • https://xuzelakojit.weebly.com/uploads/1/3/4/5/134593048/gulitumilejosiretiwo.pdfIn PDF document text
    • https://sukigemanewa.weebly.com/uploads/1/3/2/6/132681928/jiretobux.pdfIn PDF document text
    • https://polokoxukoneg.weebly.com/uploads/1/3/2/8/132816042/rokexawosoguni-rizadopisizo-zeguxupufewas.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a2ed5ef-026d-4208-a07b-fb4fda6b2202/nonugezozapirexawuvunigu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1710b897-7f71-47ba-a6ca-95fe16d160ed/84163145482.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4f6a6cb-7b57-4299-bffa-59d836dcc6fb/sarah_smith_adams.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/935cd9f2-d024-4b09-9b68-3c341257b267/hmdx_speaker_how_to_turn_on.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c99a130d-516a-4153-8cc0-e254a73528b4/how_to_use_open_office_writer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd11daec-983b-4141-953f-e7ab485aec5f/hound_of_the_baskervilles_1959_youtube.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72320916-1d9f-4504-8895-964b92b19fb2/85854007028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b48e044a-509d-4e9c-8845-64b34416bd52/buy_fitbit_flex_2_tracker_only.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69f3a23b-4a21-4407-9f00-7a0a45adb564/hp_envy_dv7_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d154de4b-5db3-46d8-9e47-73fe25ddc1a1/41433028128.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8108c8e-f9ce-45ef-b6a7-6a0ea81213f1/5614329619.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c50c1be7-1add-4bbd-823a-0a7d6385a9d4/what_does_step_10_in_a_mean_slang.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fee65dc5-6be9-4784-9415-59330522bc7e/lavavipoporale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e248faad-9719-475e-b393-afa8a7c27550/fedex_customer_service_hours_usa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e36c1e3e-b11c-40cb-b361-9d5b58f02b28/48510067888.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/737aae1d-eac6-4e8f-8750-8ddecbb5f109/how_to_disassemble_a_washing_machine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0f6ac8f-c5f1-45ce-8996-050e851e4f43/shepley_l_ross_differential_equations_solutions_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac2b37af-c4a2-49a4-8f2f-5c4b6e7dd9df/puxetab.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001087c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1087C 5612 bytes
SHA-256: 25c8fb9fc7b7003eb77eae7e990abd64e14a282b9bc51c422d825e4c984d0eb7
font_01_sfnt_off00011b81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B81 11548 bytes
SHA-256: fb46bc32f84a132857ba619fae872645e472d46df0888982530740b81bbf1fb8

Open this report in the interactive analyzer, or submit your own file for analysis.