Malicious PDF — malware analysis report

Static analysis result for SHA-256 74710849c8bc475d…

MALICIOUS

PDF

71.7 KB Created: 2021-03-10 07:42:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-17
MD5: 035c2a253aa17b910156c00a9c54037d SHA-1: 6eea5905d87dc72e90189055b92d7e2852feb080 SHA-256: 74710849c8bc475ded376cd731500968cf7c8b6c4940c13ee92e7c693666d9b9
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=redi+chek+bb-22+manual PDF link annotation
    • https://cdn.sqhk.co/guposidum/QhjxiaS/71109406716.pdfIn PDF document text
    • http://milesnires.xyz/342659006896fn8y.pdfIn PDF document text
    • https://tovibimatajo.weebly.com/uploads/1/3/5/9/135963052/benuxidanatobata.pdfIn PDF document text
    • https://fibimijisu.weebly.com/uploads/1/3/4/4/134461798/terojija.pdfIn PDF document text
    • http://tevubirufizibun.iblogger.org/thule_bike_rack_lock_instructions.pdfIn PDF document text
    • https://cdn.sqhk.co/mezugifosa/jgEu7QI/vitizabojar.pdfIn PDF document text
    • https://xufodikufidu.weebly.com/uploads/1/3/5/3/135382923/vokoxe-kogukefagunoj.pdfIn PDF document text
    • https://lobovalosidim.weebly.com/uploads/1/3/1/4/131437181/1873298.pdfIn PDF document text
    • http://bujiler.22web.org/xafujupinogav.pdfIn PDF document text
    • http://ita-bio.fun/786699987380wp4n.pdfIn PDF document text
    • https://zemabata.weebly.com/uploads/1/3/4/6/134677216/40beffb22c0031.pdfIn PDF document text
    • http://formverifiedbadge.com/white_tiger_book_sparknotesejiy2.pdfIn PDF document text
    • http://cookwellbakewell.com/51745821895w1z0o.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com/ugd/2f7815_9a8e735d66d14e4ca7bec5021e3710e1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/autosports_group_limited_annual_report_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/laradusa/canada_equifax_free_credit_report.pdfIn PDF document text
    • https://fc06435f-e709-4c80-b59d-96fa470c1a13.filesusr.com/ugd/bdc04d_c08d9a18c42148238dd2053311084e51.pdf?index=trueIn PDF document text
    • https://064d663d-f6b2-44cf-a6ad-083da5f315e5.filesusr.com/ugd/77eba6_4bf256ae302d4bd484049dfe630130be.pdf?index=trueIn PDF document text
    • https://c78ffd2e-fc3d-4272-86ca-968d835fb7ad.filesusr.com/ugd/0f9ef0_ae0fd0ec6676481eafd326df726cc494.pdf?index=trueIn PDF document text
    • https://98350ace-7ac4-4f38-a9d9-579fdad8050b.filesusr.com/ugd/9b2d9b_0bda640bdf214bf1bcae8bf58822f150.pdf?index=trueIn PDF document text
    • http://wikijozuw.epizy.com/reporter_news_sports.pdfIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/how_to_speak_in_public_with_confidence.pdfIn PDF document text
    • https://s3.amazonaws.com/dojonuta/reading_comprehension_grade_3_with_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d99b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD99B 5280 bytes
SHA-256: 2a8eeadce75e8a55e744f4e71f5dd5288bcbd76b6574b479f47c32de5e7f1379
font_01_sfnt_off0000eb74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB74 10740 bytes
SHA-256: 95231cf8e95f7eefcfdbf27117002a75667d1b94f2d632e1e00d5484d195ca22

Open this report in the interactive analyzer, or submit your own file for analysis.