Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e0ac6dd5e2253a2…

MALICIOUS

PDF

69.1 KB Created: 2021-04-04 10:37:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 60efb39022d6ad0c6ca97240c15a1afb SHA-1: 54bf1b90926aa587813a058af5c5ebc83d6579f4 SHA-256: 6e0ac6dd5e2253a201ad891055dc9ee8099056847544e5f0e0b8aeb73d112bb0
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=manco+hornet+50cc+scooter+service+manual PDF link annotation
    • http://mafesilotob.iblogger.org/78206594361.pdfIn PDF document text
    • http://gayerkan.com/the_boy_in_the_striped_pajamas_alternate_ending_fanfiction3ezl3.pdfIn PDF document text
    • http://italonewsero.site/fenusodorugodixi0mdyd.pdfIn PDF document text
    • http://trenolgia.buzz/ncees_handbook_100mxyf.pdfIn PDF document text
    • http://pochta-24.cc/wajuxiruvavosesebadike6miia.pdfIn PDF document text
    • https://poperetaro.weebly.com/uploads/1/3/4/8/134893078/burumapirug.pdfIn PDF document text
    • https://giduwuxudi.weebly.com/uploads/1/3/4/7/134716719/1e59da12734.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472213/normal_605577f6d29d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366374/normal_603c0ddf4f89e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403820/normal_602789d2651d2.pdfIn PDF document text
    • https://joverukaded.weebly.com/uploads/1/3/4/4/134433057/a6122fa6a22.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4498868/normal_6032cae0c0ee0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4401546/normal_5ffb7e2293951.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fopekexu.epizy.com/kazipirugopigagesatorugis.pdfIn PDF document text
    • https://s3.amazonaws.com/lumixi/netgear_gs116e_review.pdfIn PDF document text
    • https://s3.amazonaws.com/wewiro/55073361111.pdfIn PDF document text
    • https://s3.amazonaws.com/jinotugiwomo/37890041331.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b1654d4-efe8-4ee6-8864-4aefdf96fb9a/86256527464.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cec6a03b-acfb-4486-8d9f-cbae72c83f5c/66666185477.pdfIn PDF document text
    • https://s3.amazonaws.com/nitizobuv/how_to_disable_the_start_workspace_in_photoshop_cc_2019.pdfIn PDF document text
    • http://metusajixano.epizy.com/fulkerson_osteotomy_technique_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4aa9a3af-70ab-47f6-99a9-bb3772402867/bebivu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5eb72bf-ada4-4151-ba9e-e29ab5b47fb1/rupedesenuvawigafuki.pdfIn PDF document text
    • https://s3.amazonaws.com/setaxilitozuko/4781854813.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d25a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD25A 5372 bytes
SHA-256: 994879dc10f1d349273470451a1b2b407e68847c27dbaf2348aec905badd7b38
font_01_sfnt_off0000e486.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE486 10120 bytes
SHA-256: 97005b38ac47be20bed34335494331948078678738d7166fc6fa3c50982e2e3c

Open this report in the interactive analyzer, or submit your own file for analysis.