Malicious PDF — malware analysis report

Static analysis result for SHA-256 83579deb44f57e77…

MALICIOUS

PDF

68.1 KB Created: 2021-02-26 12:21:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 8f70de5ab7ac66fa708dc79e6797b24c SHA-1: e4463f825a9561caad4d3de011589d7453b835ea SHA-256: 83579deb44f57e7707e6e6273e5a46524286c2d5d0987d42e70f66e6de7a7390
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to SEO-optimized PDF documents, suggesting a link farm or content manipulation strategy. The primary external URI, 'https://vilenefex.ru/award?keyword=plantronics+plt+legend+pairing', indicates a potential phishing or malicious redirection attempt. ClamAV and ML classifiers also flagged this PDF as malicious, supporting the assessment of a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9671

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=plantronics+plt+legend+pairing PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4454419/normal_5fef96a1119c8.pdfIn PDF document text
    • http://prognoz-football.club/webawugemvdry.pdfIn PDF document text
    • http://yesstore.pro/think_of_me_fondly_gifg1zrc.pdfIn PDF document text
    • http://tuderoba.getenjoyment.net/what_does_physical_stamina_mean.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383805/normal_6031ee9bea668.pdfIn PDF document text
    • https://givolejemaxo.weebly.com/uploads/1/3/5/3/135345859/bafavaramakavi-visozibesedin-nekajaf.pdfIn PDF document text
    • https://buputulu.weebly.com/uploads/1/3/0/7/130738697/vogisogipix.pdfIn PDF document text
    • https://vedixoba.weebly.com/uploads/1/3/4/8/134864822/titula.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390324/normal_6024fec2527f1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jufowokedunod/gb_whatsapp_apkpure_latest_version.pdfIn PDF document text
    • https://s3.amazonaws.com/feseni/autocad_drawings_2d_free.pdfIn PDF document text
    • https://s3.amazonaws.com/fosagobomap/persuasive_letter_planning_template_ks2.pdfIn PDF document text
    • https://s3.amazonaws.com/vesubodufisi/sifejojumodusib.pdfIn PDF document text
    • https://s3.amazonaws.com/batiku/alembic_ltd_annual_report_2016-_17.pdfIn PDF document text
    • https://s3.amazonaws.com/zubuwujoxom/62434022735.pdfIn PDF document text
    • https://s3.amazonaws.com/tidigudetefumof/semetulimojimegokipixexe.pdfIn PDF document text
    • https://s3.amazonaws.com/wiwuxot/32979911586.pdfIn PDF document text
    • https://s3.amazonaws.com/kevava/33997420817.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB19 5244 bytes
SHA-256: af3d64d0b91dd619c5a8a127f06d8e7ab50966c8e48c30010558d30605e937f6
font_01_sfnt_off0000ecf8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECF8 10184 bytes
SHA-256: 2bc537326b9b1136f2cb2c55635e71b9c0413a6369d266c1bcf54395839dd750

Open this report in the interactive analyzer, or submit your own file for analysis.