Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d97e93313caf76a…

MALICIOUS

PDF

64.0 KB Created: 2021-06-09 16:14:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 27cbb8d91104f10ef599261ff03eb8d3 SHA-1: 80a89d47e0a6af62168a4e71a0de8539f11371b2 SHA-256: 7d97e93313caf76adf3e5e9f04d725c214a18a3e7d040dec74c6699ec6c9f2a5
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8273

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=magic+snake+cube+instructions PDF link annotation
    • https://dedofuzogod.weebly.com/uploads/1/3/4/3/134374436/fimoguxota_gereluwibozel_kokamimojeketa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410433/normal_600b56557af75.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367617/normal_604a4cd216620.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369164/normal_602aa865ca47d.pdfIn PDF document text
    • https://kuvijoxujav.weebly.com/uploads/1/3/4/2/134266993/zawel-zanav-vowosirodepo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365607/normal_603763692778d.pdfIn PDF document text
    • https://sonojija.weebly.com/uploads/1/3/4/7/134723635/jirufenanaxisev.pdfIn PDF document text
    • https://ladulokepalixu.weebly.com/uploads/1/3/4/8/134878898/53795d3395.pdfIn PDF document text
    • https://delitulasuv.weebly.com/uploads/1/3/0/7/130775658/duzunojoza.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495392/normal_5fed59cbaa5b1.pdfIn PDF document text
    • https://vukujaxirebes.weebly.com/uploads/1/3/4/1/134108713/bc169f.pdfIn PDF document text
    • https://divowotekek.weebly.com/uploads/1/3/4/7/134759223/7639722.pdfIn PDF document text
    • https://dobuxodujunov.weebly.com/uploads/1/3/2/7/132741154/2366523.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409797/normal_5fc829c90ced6.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fab746b-81d4-45fd-a666-4a5794e1534f/naboluruworodukoxeginil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06256da8-92b7-40fb-856b-4055c882df25/how_to_analyze_risk_and_return.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31a987d2-3071-4f37-9329-5249194bdb97/ariens_st724_snowblower_parts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/543a8077-347d-4a81-a36b-daa072580c40/62071914954.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36c44a8d-6dc0-4a0e-840b-46d7e8db428a/gisekika.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fc91507-6812-4228-b7d9-007a9d43b2f7/96775349301.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a7324bd-a54f-4111-a426-aa9ca0212900/huffy_24_womens_nel_lusso_cruiser_bike_with_basket.pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed9b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED9B 3404 bytes
SHA-256: d47b70f8f493c45c123ce7228fbe67d9eb2b9122051173010025fff87eb916b3

Open this report in the interactive analyzer, or submit your own file for analysis.