Malicious PDF — malware analysis report

Static analysis result for SHA-256 81a149799e0373b7…

MALICIOUS

PDF

75.8 KB Created: 2020-11-19 02:47:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: ad70308c1744cf9cef3fdb0e8414426d SHA-1: 8f7b1d5d550f1674717473952f0c1f9e61c8db88 SHA-256: 81a149799e0373b74412ad61794763f4ecce9128269ca370552f3e111a69cc12
214 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with at least one identified as a malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' strongly indicate a phishing or malicious redirection attempt. The ClamAV detection further supports its malicious nature, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=toshiba+qosmio+x770 In PDF document text
    • https://banafazag.weebly.com/uploads/1/3/4/3/134325205/nituxemidoledoj.pdfIn PDF document text
    • https://degitigurot.weebly.com/uploads/1/3/4/3/134337886/nofupazu.pdfIn PDF document text
    • https://fanamariruzatad.weebly.com/uploads/1/3/4/5/134514157/lupamir-momosunoketava-zusuj-bakutapevusimo.pdfIn PDF document text
    • https://vepezifu.weebly.com/uploads/1/3/4/2/134265798/pitekaniwozi.pdfIn PDF document text
    • https://nadazilagola.weebly.com/uploads/1/3/4/3/134314388/nexuxame-jiruliri-sejulusesowovep-wazalimududarim.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a404b86a-58f1-4416-883d-7f0537d9325f/31300658938.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/861cf31e-9182-415d-bb94-c88cecc4022e/fotejomudojegugitupuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c36807d4-7b4c-4e29-8d5b-c9e78363f6c4/bradycardia_algorithm_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/vojapu/30695989915.pdfIn PDF document text
    • https://s3.amazonaws.com/jezaxojipevu/sofulesov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/162b68b7-121d-43f0-9037-6a4962f27c2a/27943471631.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f9faeea-25aa-4307-aad3-39731d7d3d57/pigusonisexano.pdfIn PDF document text
    • https://s3.amazonaws.com/lovetijif/c_standard_library_reference.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17102c91-3480-4315-9b09-e315ea301ad0/sniper_data_book_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58145504-eb13-4e9e-909c-2f0dc5ee54a1/luther_starts_the_reformation_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/ridoxerisezeronowa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98da2539-c3c5-46a7-b082-40fea93de7e8/29018262322.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eab9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAB9 5300 bytes
SHA-256: 8066f894667f048b64f064d5e73635643952c3d7e54697d215e3550ba7fa23e8
font_01_sfnt_off0000fca7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA7 11112 bytes
SHA-256: d1e27485e0ba432d38601628f8f50666e7d3cc61cba86ecbbfe227e55222d6a7

Open this report in the interactive analyzer, or submit your own file for analysis.