Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a050bea4c6e0e82…

MALICIOUS

PDF

78.6 KB Created: 2021-05-03 08:47:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: e9782409a9f8f6e312e20f47dda446be SHA-1: dab201f303502995aeb13c415e0e85846278c6c0 SHA-256: 7a050bea4c6e0e82416fc9259949e8205e1991e1f18b9807c9ca3c6320d2f65e
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=z+for+zachariah+spoiler+summary PDF link annotation
    • http://femusawar.iblogger.org/active_and_passive_voice_exercises_with_answers.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403143/normal_5fe77e820699b.pdfIn PDF document text
    • http://theharaka.online/39095094752p1mro.pdfIn PDF document text
    • http://palitra-cveta.ru/comcast_dvr_box_stuck_on_boot1thhf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445101/normal_5fcf132e5e68f.pdfIn PDF document text
    • http://wabiferofuvud.mygamesonline.org/dependent_prepositions_worksheet.pdfIn PDF document text
    • http://geparup.scienceontheweb.net/anemia_falciforme_scielo.pdfIn PDF document text
    • http://zinularurupokim.iblogger.org/anexo_18_oaci.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376852/normal_5fe49c968480e.pdfIn PDF document text
    • http://pornbustyvids.com/leading_change_adding_value_documentyput3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449629/normal_603195fc6b495.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fisazivibutaz.epizy.com/angry_birds_hack_android_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/959d4476-4a11-404d-b66c-041d0feb5bb4/xexerobojarokovedakor.pdfIn PDF document text
    • http://devavivobasu.rf.gd/who_are_the_gatekeepers_of_mass_media.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3dc94ca-a543-4408-9ba9-c2f763187c4d/finding_angle_measures_of_a_right_or_isosceles_triangle_given_angles_with_variables.pdfIn PDF document text
    • http://leximadibiwojid.epizy.com/generadores_de_vapor_calderas.pdfIn PDF document text
    • http://vujapaporetakik.epizy.com/38042085210.pdfIn PDF document text
    • http://vobuketulina.rf.gd/what_is_the_pin_for_my_apple_wireless_keyboard.pdfIn PDF document text
    • http://reniletaz.epizy.com/emdr_cognitions_worksheet.pdfIn PDF document text
    • http://sepobifesedapeg.rf.gd/setadanuvurufasulozu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f184.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF184 5364 bytes
SHA-256: 74b59528cf234b9b795ea20f948e8dba303b3d9593180e40c8bf8d90e3573fc6
font_01_sfnt_off000103ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103AD 12772 bytes
SHA-256: 91a3d5959efe19f6130c86badcd00c3b5b1e1e4e9ccbd2c18c227175c3fb5516

Open this report in the interactive analyzer, or submit your own file for analysis.