Malicious PDF — malware analysis report

Static analysis result for SHA-256 82ca6862b45e5277…

MALICIOUS

PDF

182.1 KB Created: 2021-03-14 20:18:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 5c0ec1e06daa89e327ce7fcd7b0cf5c0 SHA-1: 5f1b2eea5cfb9e57db18ec61ddfd448ab1c29408 SHA-256: 82ca6862b45e52770c083027bbb17446c619a2bf634fba144d455dea84bc019b
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses an urgency-based lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=septic+shock+guidelines+2020+pdf PDF link annotation
    • https://cdn.sqhk.co/savunowudob/oYA8geA/brawl_stars_coloring_pages_leon_shark.pdfIn PDF document text
    • https://cdn.sqhk.co/jisujesox/cjahcmu/8568664819.pdfIn PDF document text
    • https://cdn.sqhk.co/jabosuve/hhh3bii/fogexenisovavelubuw.pdfIn PDF document text
    • https://cdn.sqhk.co/xunalafugapa/hhfiRUH/16735105835.pdfIn PDF document text
    • https://cdn.sqhk.co/kewixoretuze/c3hfhja/vunovafi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480393/normal_5fd675af65c2e.pdfIn PDF document text
    • http://rajulikarizamu.iblogger.org/58083138592.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385231/normal_600f23e2d20f0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365599/normal_602615f202531.pdfIn PDF document text
    • http://motovepom.iblogger.org/ginanekoku.pdfIn PDF document text
    • http://jigofajun.22web.org/balada_para_adelina_piano_partitura.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e73e181-0f6f-4dc4-9a9d-8225185d4650/febexo.pdfIn PDF document text
    • https://d451e762-8e00-4155-9971-9512d28d2528.filesusr.com/ugd/b52961_3de3931fc8b24e028a9112c2d49f062e.pdf?index=trueIn PDF document text
    • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_bc81d7cd33a0434e8d254d7ec78a5851.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1d57ee1-2a1f-404b-bd02-2fd0d70f71b2/origem_do_carnaval_brasileiro_wikipedia.pdfIn PDF document text
    • https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_e37006d5453b429890dc781ececfa9e6.pdf?index=trueIn PDF document text
    • http://zukuvib.rf.gd/ff14_dark_knight_guide_5._0.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80e1cf32-183e-4f87-a41b-adaa4b233946/ilive_under_cabinet_radio_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f46ee2b-7be7-43c8-8b5a-0a34b0a23284/39375767596.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e618930-d5f7-4df7-890f-5447b365a17b/25382529268.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1b880a6-74e8-4641-a980-842145d61883/cisco_csr_1000v_eve-ng.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00028c8b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28C8B 5552 bytes
SHA-256: 5c0d10275a9039e91597801166e9b577c17dadf5ce0300b46f43370858f17373
font_01_sfnt_off00029f7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29F7E 13996 bytes
SHA-256: 3d35fd297f812f82942adcf90826240a89594a3ec471e1b7fb1e1d3cb8cddbbe

Open this report in the interactive analyzer, or submit your own file for analysis.