Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a29e5b9ec8a612e…

MALICIOUS

PDF

66.6 KB Created: 2021-06-13 14:10:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: a151333e50711fae304c386e051ec328 SHA-1: 810280a623a7d21f9e844423ee91f99af0f3120f SHA-256: 7a29e5b9ec8a612e148f68247de0c9b71c20b6440545e8a78364273494fefd25
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9740

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://coretry.ru/pbw?utm_term=happy+birthday+images+cake+name PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5546c0e3-9c42-4c99-bb10-b33e4ae5c6ac/did_ashton_kutcher_and_mila_kunis_get_married.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03208474-af63-4434-ae06-9a99cb0aa0dc/80654428554.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89ec36e0-fd88-4009-9a37-11a176acfb64/lorinowejifegux.pdfIn PDF document text
    • http://divogatupum.pbworks.com/f/gta_v_all_treasure_hunt_locations.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cac6bc3-9770-4991-87e0-73315b098ffd/cyberpunk_2077_multiplayer_online.pdfIn PDF document text
    • http://najapenoz.pbworks.com/f/gimumuwiruwisot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c035a130-8ad6-4550-bfbb-81fda382c719/dimikumexazojosifadanakod.pdfIn PDF document text
    • http://nugewus.pbworks.com/w/file/fetch/144524325/18789846816.pdfIn PDF document text
    • http://bowawesup.pbworks.com/w/file/fetch/144577668/vevigumasibu.pdfIn PDF document text
    • http://goferupemo.pbworks.com/w/file/fetch/145089165/what_is_anna_quindlen_claim_in_a_quilt_of_a_country.pdfIn PDF document text
    • http://bazibenis.pbworks.com/f/90085372069.pdfIn PDF document text
    • http://jumedew.pbworks.com/f/wezazalazejebegutibofoza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e662f83b-76de-46fc-838b-f4c4cb86326e/novarariduji.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/266a8f10-c4d6-4af0-9a0b-fd517b41b58f/wagner_paint_gun_lowes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7582ca9-ee02-41b3-93d1-e1255be4f238/57811790071.pdfIn PDF document text
    • http://xexufokug.pbworks.com/f/leonardo_da_vinci_skull_drawing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3f467a4-d0dc-43c2-8a8a-6098ba28385d/how_often_should_you_change_transmission_fluid_ford_explorer.pdfIn PDF document text
    • http://ronejoxerer.pbworks.com/w/file/fetch/144932805/wapegemewosu.pdfIn PDF document text
    • http://fuxedemama.pbworks.com/f/jacques_le_goff_libros.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e649fa0f-1243-48de-b679-3e4534fa2702/93456965580.pdfIn PDF document text
    • http://vogituvu.pbworks.com/w/file/fetch/144495504/photo_to_video_maker_software_free_download_for_windows_10_32_bit.pdfIn PDF document text
    • http://pamotekegopa.pbworks.com/f/nudunapatu.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d79a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD79A 5724 bytes
SHA-256: 3f9504508787fe1b0b2fb8596a4f51f5904e2a8077152df0da4a8bc34c0b54c0
font_01_sfnt_off0000eae7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAE7 10232 bytes
SHA-256: ad8f35c8aa712a2eef3b32c66ea6509601a235b91a068411ff928cb2f60f0f51

Open this report in the interactive analyzer, or submit your own file for analysis.