Malicious PDF — malware analysis report

Static analysis result for SHA-256 81891ae1c680014c…

MALICIOUS

PDF

74.9 KB Created: 2021-05-21 04:05:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 129eec4054feebe872edc585f55b60c8 SHA-1: ad793022bbdd3d9a6c75fca45fc04ac17ff89982 SHA-256: 81891ae1c680014c9be7c16e024e66619760330c9ae747e0ce3d33facf0260eb
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=meluha+in+hindi+pdf PDF link annotation
    • https://wosabizovores.weebly.com/uploads/1/3/4/5/134577485/085ff9.pdfIn PDF document text
    • https://menimewutezosel.weebly.com/uploads/1/3/3/9/133997121/1043063.pdfIn PDF document text
    • https://tasusigogifu.weebly.com/uploads/1/3/5/3/135303518/d16282157d6.pdfIn PDF document text
    • https://vajilitoseg.weebly.com/uploads/1/3/1/4/131437648/tisezomabob.pdfIn PDF document text
    • https://meboguvogo.weebly.com/uploads/1/3/1/4/131437667/posavajelumanatifuju.pdfIn PDF document text
    • https://xavilisepu.weebly.com/uploads/1/3/4/2/134235747/nogixoz.pdfIn PDF document text
    • https://xafadefuvabajil.weebly.com/uploads/1/3/0/7/130776308/91dd67eb.pdfIn PDF document text
    • https://sesorefamasupuv.weebly.com/uploads/1/3/1/0/131071262/8079540.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412158/normal_605c22f6bae9f.pdfIn PDF document text
    • https://tisuzozolida.weebly.com/uploads/1/3/6/0/136087901/wadesov-taliluwa-lusipa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501208/normal_602e4d5013297.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460688/normal_6058c9b14f1dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488569/normal_60597f94b4827.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/watch_band_length_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/693a23f1-1422-4713-9586-2fd0f03621c7/stephen_hawking_married_jane_wilde.pdfIn PDF document text
    • https://s3.amazonaws.com/gavexilatuvitaz/resistor_color_code_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/gomakobez/outlook_calendar_csv_import_format.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd77189a-7341-444c-aace-b6f279e6a37b/what_does_bow_symbolize_in_the_bible.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cb3e441-a1a1-44bc-8572-5d1c4e5570a8/stihl_ms170_chainsaw_price_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1eeb4273-a867-4e93-be78-968fce1a6e85/how_to_fix_my_bissell_proheat_pet_carpet_cleaner.pdfIn PDF document text
    • https://s3.amazonaws.com/lomogas/bond_fund_of_america_fact_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/how_often_dpf_regen.pdfIn PDF document text
    • https://s3.amazonaws.com/xipavir/35343182383.pdfIn PDF document text
    • https://s3.amazonaws.com/wutisigila/88730904434.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7D9 4860 bytes
SHA-256: c53618108e9c0471480ecd8eb356bdd044710aecc3d38f9c0f9f93153dfd4295
font_01_sfnt_off0000f86d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF86D 11540 bytes
SHA-256: b050cbf12c9e827ea819341ccb2a4275fff9091564008182130af69b5f625ae9

Open this report in the interactive analyzer, or submit your own file for analysis.