Malicious PDF — malware analysis report

Static analysis result for SHA-256 7571efa05b02b0c7…

MALICIOUS

PDF

81.4 KB Created: 2021-05-29 19:39:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: bce5466b3a62010d2bba37af7a934fb4 SHA-1: 12b02e92a46bf26930f75bd4ad1e313284c35c16 SHA-256: 7571efa05b02b0c7a1c73621d6c99d29fdc3b2b4745e71ffa598f87d28952218
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=twenty+lectures+on+algorithmic+game+theory+pdf PDF link annotation
    • https://zezuwosizu.weebly.com/uploads/1/3/4/4/134459619/4ef8f8c06d6c60.pdfIn PDF document text
    • https://nirotagikul.weebly.com/uploads/1/3/5/9/135992947/9130936.pdfIn PDF document text
    • https://vebupefipi.weebly.com/uploads/1/3/4/4/134497137/fd00798.pdfIn PDF document text
    • https://lewejasolon.weebly.com/uploads/1/3/1/4/131437246/8619697.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/89273374-9e41-4f7f-8c91-283b80ce3901/tizefosel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8f8b9f2-f652-4323-841e-76b66367636c/20805319927.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2b20a4c-819c-4de6-b6dc-f0b3f2bb1128/46611874775.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6169d616-c3e5-4a14-a8b6-089c3f13f5c0/58301284102.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82af413a-bca3-4479-b513-8e8f7e1160a4/xurodo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94ef4fc3-2352-4567-b3da-a11fd28b1adb/pawubotuniz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89939b89-3e73-4e5d-98ab-4c4a7309e4f9/lisodasotidobi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13f87280-6ecd-48f8-81a9-dd7968dedefd/aquasource_shower_faucet_cartridge_removal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94003451-8138-449b-bbec-98bd1d6557eb/xijikumipanu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dcc8dc33-1576-4045-aabb-d7bbff5a9a61/psychological_assessment_services_riverside.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e986346-048c-4dd8-bea3-430c62290558/63250194180.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b005553a-11c1-4e94-941d-c0faffbf45ec/sujevikamomifemiwate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87cb68d9-e052-4ceb-be07-1f89be6c587c/69442595359.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33f6c97b-9047-417f-93e7-a18586555e41/how_to_do_a_simple_family_budget.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98d2d9e5-b713-4587-860c-5ddcc1a4d71d/honda_pilot_owners_manual_2011.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de7cf388-c245-4bdf-afcb-9e804bcc72d1/71307727876.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ed0ee8f-6768-42d7-8955-184f3d06485b/best_nitecore_flashlight_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7dcae1d-807d-4059-a76f-8497fedd1dd1/63561725151.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB99 5712 bytes
SHA-256: cb34a9ee7f676b6c0c05614a9c3a28a06b3ed81ffce606f6347ca938ddf69f74
font_01_sfnt_off00010ef8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EF8 11804 bytes
SHA-256: da7ac0fda1c08d9c514219a823e474941826777d145e2d9d2a4124ca2d8742f9

Open this report in the interactive analyzer, or submit your own file for analysis.