Malicious PDF — malware analysis report

Static analysis result for SHA-256 84be4c136437134b…

MALICIOUS

PDF

88.4 KB Created: 2021-05-10 08:26:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 2fbf94f43c9e92bf3bac2f3efd10b437 SHA-1: 510ef55943f6324c3edf575b2390fb9602b8622a SHA-256: 84be4c136437134b24f392abfa5dd63cfde699cd2f8683d4b6c29de9f73f02a4
216 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses brand-impersonation credential phishing. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://nokaxogu.weebly.com/uploads/1/3/4/5/134520383/suvogutisarabi.pdf.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=the+game+of+life+2+apk+2020 PDF link annotation
    • https://nokaxogu.weebly.com/uploads/1/3/4/5/134520383/suvogutisarabi.pdfIn PDF document text
    • https://tesewipelevifiv.weebly.com/uploads/1/3/3/9/133997178/6519568.pdfIn PDF document text
    • https://gibolavisijubaz.weebly.com/uploads/1/3/0/8/130813033/e3473cb1a.pdfIn PDF document text
    • https://jojeditisiteso.weebly.com/uploads/1/3/1/6/131606373/238796.pdfIn PDF document text
    • https://givifajilodox.weebly.com/uploads/1/3/0/8/130874655/8624505.pdfIn PDF document text
    • https://wotujajatedigi.weebly.com/uploads/1/3/5/2/135295120/zesenetudade.pdfIn PDF document text
    • https://dumuzuvo.weebly.com/uploads/1/3/4/6/134695275/49726.pdfIn PDF document text
    • https://besugadofozoxi.weebly.com/uploads/1/3/5/3/135396803/wutisabavubu_bixokireronese_xovuw_fegoraxokax.pdfIn PDF document text
    • https://ritibamubube.weebly.com/uploads/1/3/1/4/131437410/budigix-somifaxo.pdfIn PDF document text
    • https://xekekulok.weebly.com/uploads/1/3/1/8/131857590/6728664.pdfIn PDF document text
    • https://bemuzulezevateb.weebly.com/uploads/1/3/4/4/134440878/203e8.pdfIn PDF document text
    • https://gesaseli.weebly.com/uploads/1/3/1/3/131379828/jiketebozugowole.pdfIn PDF document text
    • https://govewusig.weebly.com/uploads/1/3/0/9/130969429/jonapezitumezele.pdfIn PDF document text
    • https://pesuzipowezav.weebly.com/uploads/1/3/1/6/131636843/d69254.pdfIn PDF document text
    • https://wemodolitafuroj.weebly.com/uploads/1/3/6/0/136055174/1588502.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zunaporam/plantronics_backbeat_fit_operating_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa8ed5d0-4780-4917-87d8-2cff31d4b5ec/why_do_i_like_getting_into_arguments.pdfIn PDF document text
    • https://s3.amazonaws.com/toliwudalamem/47618632737.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac9b7d30-28e5-4f5b-89cd-bf8adedcdbd2/gumonamixazulomuselazap.pdfIn PDF document text
    • https://s3.amazonaws.com/zoluwivebiro/velopidotojarimebedasur.pdfIn PDF document text
    • https://s3.amazonaws.com/womirofop/lofoten_islands_guided_tours.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9acd55e3-d734-467b-b86b-92fbecff3468/51093222728.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ece0e2f-3831-4550-b81a-60426eb8f8d3/formato_apa_sexta_edicion_descargar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3a6ba45-575d-42d8-b090-65635e89e7a1/84769526266.pdfIn PDF document text
    • https://s3.amazonaws.com/rakabexozu/25973129770.pdfIn PDF document text
    • https://s3.amazonaws.com/guwutivupudutu/rca_voyager_tablet_with_keyboard_walmart.pdfIn PDF document text
    • https://s3.amazonaws.com/tigewibejageju/garmin_gpsmap_60csx_marine_maps.pdfIn PDF document text
    • https://s3.amazonaws.com/makixibawumebol/pakimekopuwixevakulibub.pdfIn PDF document text
    • https://s3.amazonaws.com/zizene/fodexigemomivejewuroji.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F5D 4932 bytes
SHA-256: 20fe5903c2643aece693e4ab37a5f5197a047cea89c5686cbed8c079c46d4502
font_01_sfnt_off0001202f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1202F 11004 bytes
SHA-256: 32f44b8a9dac404b3fcf1ae23f0cd54eddbe6596fb07c31df9ac57e548dd8472
font_02_sfnt_off000145a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x145A6 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.