Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ed0a5b260205da8…

MALICIOUS

PDF

75.5 KB Created: 2021-03-09 20:22:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: e2d412f6017aa5b21965bf11008914b1 SHA-1: 9351487d7da1362704b05b0bd8dc59ca36b4aea6 SHA-256: 6ed0a5b260205da857d41fe9b48fa0d31da619973aa6257d98c7374d65f7e45d
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/123?utm_term=sources+of+african+history+notes+pdf PDF link annotation
    • https://cdn.sqhk.co/zupuguvawaj/icijVAv/business_management_entry_level_jobs_ottawa.pdfIn PDF document text
    • https://cdn.sqhk.co/nopawuwam/hjggG4f/digi_easy_phone.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://8b83d164-5e56-46cc-b941-48f48810ddf3.filesusr.com/ugd/76ce43_755158bff95a4b959f4d31512369eaa3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tubukeganuji/disney_uk_tv_guide.pdfIn PDF document text
    • https://780c8f77-0f51-49ab-8dd1-60a90eb210a4.filesusr.com/ugd/1b8612_f7ac2977a237413c889e3e7f37fe6a1f.pdf?index=trueIn PDF document text
    • https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_86a88498f59b416bb318f3a0b53281e6.pdf?index=trueIn PDF document text
    • https://f8d4b294-f952-4a11-85e8-0a3036f9bdaf.filesusr.com/ugd/ad8f3a_970b30b2f7a44ea5b92ddc82676dca56.pdf?index=trueIn PDF document text
    • https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_096560ccd3184c28897a88832123cf77.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gavobawum/32963213954.pdfIn PDF document text
    • https://s3.amazonaws.com/tobaziw/moxalenovara.pdfIn PDF document text
    • https://4e33067b-0f13-4bed-bb9c-ea95f768fd7c.filesusr.com/ugd/23924c_1f7f312d76fd407aa6a62d4f67baf512.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tuxalowafokuvo/mds_3.0_training_classes.pdfIn PDF document text
    • https://6bb2b61b-82bf-473b-8365-63ddb02ddbdd.filesusr.com/ugd/d55797_3a1e2011e78041599540efd5ead3540e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fifuto/google_drive_backup_and_sync_offline.pdfIn PDF document text
    • https://s3.amazonaws.com/lokijuronig/formule_du_dioxyde_de_carbone.pdfIn PDF document text
    • https://s3.amazonaws.com/gedexim/lock_sheet_in_excel_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3aacf812-626a-4a02-ae03-03479e0b0362/dowezitiferusejesisi.pdfIn PDF document text
    • https://47ab6ce1-aee6-4086-a8e7-31fe393d2411.filesusr.com/ugd/afbef4_b0c5190ec7d1416cbb0a5232f96dab4a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/subopukomanaw/gafujisoza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10ad2d4a-9266-4a56-a7bc-fabd9cb7bea4/the_kybalion_review.pdfIn PDF document text
    • https://bd7a0a6f-bbfd-49cc-ba41-c3f2778102d9.filesusr.com/ugd/9ea91e_ecd0e8fc0f134d1a91b8a5a851a0dd53.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9D5 5416 bytes
SHA-256: 29c28eec4b456031fbb315adbc57812db672f787d46556ff33d2f6be04a53725
font_01_sfnt_off0000fc46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC46 10668 bytes
SHA-256: 1135a13db38b9afb0c446fef8b7cc1dc0cfd6de09505dc93fcd1c4ea47970f27

Open this report in the interactive analyzer, or submit your own file for analysis.