Malicious PDF — malware analysis report

Static analysis result for SHA-256 8422abbd5bd0936b…

MALICIOUS

PDF

81.2 KB Created: 2021-04-21 02:32:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 15d9f9283540d0e37e91cb5b22c0d72f SHA-1: 556fe4ce43f4c27d50011034e45758d061aeaffb SHA-256: 8422abbd5bd0936b72eac937135be6131409bb17a1d7349035b2f2a3c220dd75
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or malware distribution attempt. It contains numerous embedded URLs, many pointing to disposable domains, suggesting a link farm designed to redirect users to malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically highlights this behavior, indicating the document's primary purpose is to host and distribute links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=easy+piano+chords+songs+hindi PDF link annotation
    • http://hytri.com/sagovujijhbc0t.pdfIn PDF document text
    • http://hempmap.ru/what_is_the_meaning_of_community_development_policydmzyr.pdfIn PDF document text
    • https://tixonanixob.weebly.com/uploads/1/3/4/8/134890866/4712308.pdfIn PDF document text
    • http://olivamebel.com/75093659809ikee1.pdfIn PDF document text
    • http://persequenteamsohbet.com/40118385494ulk78.pdfIn PDF document text
    • http://spain50off.info/86935840230wndmg.pdfIn PDF document text
    • https://lexabefi.weebly.com/uploads/1/3/1/3/131384613/7489960.pdfIn PDF document text
    • http://italywow.info/the_critical_thinking_company_answers19q73.pdfIn PDF document text
    • https://burevojaziji.weebly.com/uploads/1/3/4/7/134729690/fivepotututajo.pdfIn PDF document text
    • https://lefiletigej.weebly.com/uploads/1/3/4/5/134597596/fofofulerobo_mejerabar.pdfIn PDF document text
    • https://soxokememomoj.weebly.com/uploads/1/3/1/4/131438280/0d979aa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb6e35cf-2b1c-468f-80a7-bbf8edb52c38/gozepivofipedivutofebu.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/put_off_phrasal_verb_meaning_in_malayalam.pdfIn PDF document text
    • https://s3.amazonaws.com/nitidadufetenu/fem_natural_boundary_conditions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7471c806-1bc7-4dfc-ac94-07559e6f3b95/how_much_does_a_pressure_washer_cost.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9533ca0d-4a10-4305-91bb-da33b0519602/metro_2033_stuck_outside_library.pdfIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/37627505273.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2da23419-a9bd-47bc-945d-8419b8578589/7884293303.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fb2ffd5-9005-4d91-bbd8-bca3ce5465ab/2971997464.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a70af215-31a7-4447-bdb4-5fa92fc66b4e/26405712917.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fec9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEC9 5360 bytes
SHA-256: 8fea0edd4887c75a4ba351d7311ef544de8e2637ab79c84e9c3c3edfa9f3576f
font_01_sfnt_off0001110b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1110B 11256 bytes
SHA-256: c7706e96924384e380f1317a073184a9918a43fafb21a6952d4bc18b7bbc89d7

Open this report in the interactive analyzer, or submit your own file for analysis.