Malicious PDF — malware analysis report

Static analysis result for SHA-256 85f17154c30d034d…

MALICIOUS

PDF

101.0 KB Created: 2021-03-17 12:46:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 7aeb42365662783e061862df3b4022fd SHA-1: b397142ff5ee232c41f1867a46c6ca1fe4a76047 SHA-256: 85f17154c30d034d541ef3b2003602749d360d4f6978b44d0cb7736cd912e630
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=skyrim+belt+fastened+quivers+dual+sheath+redux PDF link annotation
    • http://ketoxitigojaluk.sportsontheweb.net/whats_in_the_sky_tonight.pdfIn PDF document text
    • https://mufiguxibetifo.weebly.com/uploads/1/3/1/6/131607440/zuxuji_xenewotom_ronobude_zisojog.pdfIn PDF document text
    • http://wwnews.site/48676372354qcrau.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427076/normal_605117bc0d576.pdfIn PDF document text
    • https://zisidolig.weebly.com/uploads/1/3/1/3/131379992/xukeluxe.pdfIn PDF document text
    • http://ig-copyrightviolation.com/world_war_z_game_trophy_guidexu6wq.pdfIn PDF document text
    • http://fanisore.sportsontheweb.net/12370840471.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371498/normal_5fde0d6f319d1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450145/normal_5ff9effd8c219.pdfIn PDF document text
    • https://gexipatar.weebly.com/uploads/1/3/1/6/131606255/banurisovowevojo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459625/normal_604b1f3dad769.pdfIn PDF document text
    • http://reawolt.online/seguridad_y_salud_en_el_trabajo_que_esf18h3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488317/normal_5fc6f03275079.pdfIn PDF document text
    • https://zujanotoze.weebly.com/uploads/1/3/4/4/134476942/c705683.pdfIn PDF document text
    • http://gladkoe-telo.xyz/z_nation_wiki_cassandra4saq8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/333583e2-c100-4443-a170-813be9cbc0cb/74801457270.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d527568-bcb8-468e-be56-a35052cd62d0/56691670385.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a52d30a1-74ae-43b3-b2d0-51651e80e030/kasadorovotu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B91 20156 bytes
SHA-256: 41795b290ea68bdeb6dde7b0bfaee7d976f4337f89a33d0d75ccee90f1783056
font_01_sfnt_off00014c83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C83 5812 bytes
SHA-256: 47cf9e4ec4c0f68a01a1a912eab5656454c5862dce1a91c1649271853910090c
font_02_sfnt_off0001602a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1602A 11300 bytes
SHA-256: 019b4ad6380b91b424bef91e05eb01ef101e5aa3180c0e810809eb95be4345f3

Open this report in the interactive analyzer, or submit your own file for analysis.