Malicious PDF — malware analysis report

Static analysis result for SHA-256 78551ac49c4f5a7d…

MALICIOUS

PDF

79.9 KB Created: 2021-03-16 01:44:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: fd50feb8c9d976b8b8e91fece7cd894f SHA-1: b8beb90d276f1fbd9af840d0aece3e0d748ceee4 SHA-256: 78551ac49c4f5a7d28ebef721b30d309fcdc2ae887edf05d613570bd81510f31
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=chief+architect+free+software PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4451229/normal_60485272ea98a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461495/normal_5fe7fdaebacc7.pdfIn PDF document text
    • http://febirag.iblogger.org/92495541018.pdfIn PDF document text
    • https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/sudiseterujur_dixupujek.pdfIn PDF document text
    • https://wofapebubedidu.weebly.com/uploads/1/3/4/5/134524968/zagapovafit.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386363/normal_60112e7a2ffc3.pdfIn PDF document text
    • https://cdn.sqhk.co/nexetifosam/hjieh3B/neon_pink_nike_womens_running_shoes.pdfIn PDF document text
    • https://wabalolosezuluf.weebly.com/uploads/1/3/4/4/134462862/povur.pdfIn PDF document text
    • https://rowevopa.weebly.com/uploads/1/3/1/8/131872281/mimus.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369516/normal_600b364246d6c.pdfIn PDF document text
    • https://bamufikike.weebly.com/uploads/1/3/1/6/131606241/2339535.pdfIn PDF document text
    • https://ludexibof.weebly.com/uploads/1/3/4/6/134638297/6c865823256e5b.pdfIn PDF document text
    • https://cdn.sqhk.co/xawobovuji/iEjfjie/42915150209.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467910/normal_60081cddc53ef.pdfIn PDF document text
    • http://pumujavebedopa.iblogger.org/video_dangdut_adella_terbaru_full_album.pdfIn PDF document text
    • https://siwufofewexiv.weebly.com/uploads/1/3/5/3/135329456/jikikadad.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zanebinelit.rf.gd/beamforming_mimo_meaning.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/272af6b9-1e87-4887-95a9-77ca105b3303/raxibefuk.pdfIn PDF document text
    • http://befokube.rf.gd/prince_lestat_and_the_realms_of_atlantis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd28ad0f-66f8-4aba-9032-6d8bcd824ee6/21086961417.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1314662-dcf5-407d-8d56-97c962f59ced/74891372759.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e62e66ba-3a1b-46dd-ba35-b4a4e1b37db6/hbs_800_manual_espaol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000faad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAAD 4936 bytes
SHA-256: 06c3d8afba2ebcc78ac94ac2b9a7970b44683b63e382e7e1ae63b6f74d89f293
font_01_sfnt_off00010b7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B7F 11492 bytes
SHA-256: f1fa8139dde30bbe96bb8201ef16dcf493d25a0a411eadf8867dfdf4d4227300

Open this report in the interactive analyzer, or submit your own file for analysis.