Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e1bbf52e216000d…

MALICIOUS

PDF

83.6 KB Created: 2021-01-02 21:07:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a6440660197eae04156b3d8a7e356c1d SHA-1: ccb381b001e0bd5e15d77627f482cd870bc8e396 SHA-256: 6e1bbf52e216000dd73cdfe9cf1b0c914d093afa303ac268020fbf16115c0194
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=mashallah+in+arabic+text PDF link annotation
    • https://puraxexi.weebly.com/uploads/1/3/4/7/134718411/1195586.pdfIn PDF document text
    • https://fotijaxak.weebly.com/uploads/1/3/4/1/134108731/pimubuno-dinij-punaliwanobeva.pdfIn PDF document text
    • https://mujabimebedegi.weebly.com/uploads/1/3/4/2/134234846/divugatugewi.pdfIn PDF document text
    • https://pexajutamog.weebly.com/uploads/1/3/4/7/134759810/rugurawosuvo.pdfIn PDF document text
    • https://cdn.sqhk.co/kepebeso/T9mMPo7/jokokoxadajuxoxutufes.pdfIn PDF document text
    • https://cdn.sqhk.co/dimusokobab/Flhjtid/tobilir.pdfIn PDF document text
    • https://cdn.sqhk.co/pimibopugugo/eOKfFie/atlas_copco_buyback_offer_2020.pdfIn PDF document text
    • https://dejolezeg.weebly.com/uploads/1/3/2/8/132815968/putimepet-riseg-luxigan.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4e9b8de-14bd-47ff-8791-268c22c3e093/24975483532.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f9b75a3-e8a5-4dd5-83d8-2c698bca5423/piwerotezunuxi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/200fd5a1-f931-4ac4-a50f-56eb82604483/nusit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c75affb6-17d2-4bb9-9684-a6922a86496a/15098937417.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eefd3c3a-ca25-4c0c-97d1-bb238f4a3ce2/mythbusters_scientific_method_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80c6ee51-f7da-471b-b523-022379d92161/1931290456.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bf5668b-c7bb-4a38-af54-62556c5af974/56009514769.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2aff258c-d591-4eb3-a18e-0cf116a9ee7b/eric_church_songs_new_album.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e295.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE295 3028 bytes
SHA-256: 2a58cb912b8d0b1d3a8ee7d96a3f8aada0dafd9b4c12bd836ff2d33ab9786c1c
font_01_sfnt_off0000ed72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED72 5100 bytes
SHA-256: 8c6b39293ac4e53aa7446bae5f12f6962153762918af17bb68dccb985f1849c7
font_02_sfnt_off0000fed4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFED4 12592 bytes
SHA-256: 71ac08bcd36598a39cc69557dee20fe7b586cefcb167b6f558881c1e18dbd4e0
font_03_sfnt_off000127a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x127A3 17152 bytes
SHA-256: 375bd1f868d7ebb55c883e35de6aba3f06291d970568bb5b60b1a7b6c373b75a

Open this report in the interactive analyzer, or submit your own file for analysis.