Malicious PDF — malware analysis report

Static analysis result for SHA-256 859f65b74d9ded94…

MALICIOUS

PDF

75.1 KB Created: 2021-03-28 13:45:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: e3291e8a0b09cffe59c278920f2ea37a SHA-1: d473f8477a84a75ca9d49dac1b784f5cdac52d32 SHA-256: 859f65b74d9ded94bbd9e98736facdbed8f2ce49106b8cd96942dd65d7b5723c
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=cartoon+movies++480p PDF link annotation
    • http://makamar.xyz/73495338373tzpo6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489994/normal_5fe44eb0b5f25.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458829/normal_6047f5e002ff3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444100/normal_60602d348bac8.pdfIn PDF document text
    • http://tehnoprom.org/54891640209e72la.pdfIn PDF document text
    • http://contentmedialiteracy.com/physic_giancoli_6th_editionmuqj8.pdfIn PDF document text
    • http://1-bog.ru/96705394427vsc7s.pdfIn PDF document text
    • http://ukranews.icu/jabulozogusibisoxgnqje.pdfIn PDF document text
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdfIn PDF document text
    • http://migerov.xyz/division_free_printable_worksheetssxte4.pdfIn PDF document text
    • http://imedo.ru/midnight_sun_audiobook_stephenie_meyergcf1a.pdfIn PDF document text
    • http://vvinorama.fun/zujulefawigagafibaqboet.pdfIn PDF document text
    • http://parkji5x.xyz/62042886486v5ern.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/dde464d6-404f-489a-95ea-e3aec9be799d/what_company_owns_greenworks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a827ff9a-ec70-4305-8567-db41eaf0ecbe/busuperukakevotuve.pdfIn PDF document text
    • https://28481333-1ef2-46fb-8ebf-d56c3f24acbc.filesusr.com/ugd/314c35_887ff92fc4f34c7b8f9097bcbefb28bd.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2eff7d1e-4dfc-45c2-b163-ad1a7dfa9d2f/jowudumoj.pdfIn PDF document text
    • http://defefefesid.rf.gd/gasejedizodakonovis.pdfIn PDF document text
    • http://gejorefirizo.epizy.com/tagonipoko.pdfIn PDF document text
    • http://zowujobosega.rf.gd/lavod.pdfIn PDF document text
    • https://23da7c74-6e14-424a-b22a-901aa35eafb1.filesusr.com/ugd/9cc572_90a00da3edf948b6bf22379bcc7ab08f.pdf?index=trueIn PDF document text
    • http://raseloxezonavo.epizy.com/vinamofiwidikis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7466804f-28b6-473b-a1f3-66c241090ac4/hoover_steamvac_ultra_manual.pdfIn PDF document text
    • https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_4a467c5fe7494f01bbdc7c932d188103.pdf?index=trueIn PDF document text
    • http://xovurilarilowi.epizy.com/minecraft_bedrock_custom_skins.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/486390df-6a07-44b1-9c47-93ef7c66ad5c/83699390073.pdfIn PDF document text
    • https://9e7b01ce-91ce-414a-93c5-ade8df4b7359.filesusr.com/ugd/cfbfd2_4894242130a1430d9f427ac7e4904316.pdf?index=trueIn PDF document text
    • https://c81c1a69-aec6-471c-ac34-7a6800eafc69.filesusr.com/ugd/9ef1ea_1ea53984203d479e82b68d70faa43e13.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e519.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE519 5324 bytes
SHA-256: 8ea370e853e3b4ee7e8e3137a49f2e1bd8c7cd192af3dc04f4c670dc0155898b
font_01_sfnt_off0000f723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF723 11380 bytes
SHA-256: 652467fcb93c469da66ef8261163cb739ee624f81534bd20918aa527aebd574b

Open this report in the interactive analyzer, or submit your own file for analysis.