Malicious PDF — malware analysis report

Static analysis result for SHA-256 6df9d4009cf2dc52…

MALICIOUS

PDF

61.3 KB Created: 2021-03-08 20:17:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 55c01101a0651e3735d5ff6b51e3c6d1 SHA-1: 576ea65f99450ff800ad94ecda99938e122c5097 SHA-256: 6df9d4009cf2dc52a65370d8a9703c4eb567a1818aaa7a7b32f9316463d849e7
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8478

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=christmas+carol+songbook+printable+pdf PDF link annotation
    • http://optalpha.com/prefixes_and_suffixes_worksheets_5th_grademb6md.pdfIn PDF document text
    • http://apparently-home.com/hasselblad_500c_price_guidexryst.pdfIn PDF document text
    • https://cdn.sqhk.co/lugizumevemu/hdLN8tY/stories_for_instagram_animated_maker_story_videos.pdfIn PDF document text
    • https://megogira.weebly.com/uploads/1/3/4/5/134590171/4192411.pdfIn PDF document text
    • http://pe50off.pro/mr_sandman_the_chordettes_freei4w1q.pdfIn PDF document text
    • http://lynciguest.com/sole_e95s_ellipticalrsgqp.pdfIn PDF document text
    • https://rinulokol.weebly.com/uploads/1/3/4/8/134868038/zufobatab.pdfIn PDF document text
    • http://raftgjgr.space/2806024497eq681.pdfIn PDF document text
    • https://cdn.sqhk.co/ponesigis/gbjifhg/99671186049.pdfIn PDF document text
    • https://safalijig.weebly.com/uploads/1/3/1/0/131070993/koverakurenov.pdfIn PDF document text
    • https://cdn.sqhk.co/muligumixe/jYdePhb/juventus_players_2019_salaries.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a27236b-9e66-43b8-8d4b-31f3fbdcb186/dell_e7450_review_cnet.pdfIn PDF document text
    • https://s3.amazonaws.com/wefemabeni/50497131010.pdfIn PDF document text
    • https://9907981b-0bc7-4fd3-a434-169f7cdadf42.filesusr.com/ugd/575363_b91e26bd40f94a4ea8eb216024e613b7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tetofamuxulil/javascript_from_website.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/671e3c38-705d-48e6-832e-2e13055906fa/fifty_easy_classical_guitar_pieces.pdfIn PDF document text
    • https://s3.amazonaws.com/jewizopukuni/loxopigo.pdfIn PDF document text
    • https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_98194feb34bd4cc1b21a824a8b006aed.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c14a2f2f-9fb0-4a70-b341-b26930ad7073/ritumajosegujegom.pdfIn PDF document text
    • https://3c3b6f52-20a2-448a-be11-eec5930c502f.filesusr.com/ugd/0ca786_e34b26747662464ba2cd96afc064f4b9.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e67e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE67E 5680 bytes
SHA-256: cf84e960d634db46d8a37aeab6944283a93b90867974101cf4fa44536ba15e3b

Open this report in the interactive analyzer, or submit your own file for analysis.