Malicious PDF — malware analysis report

Static analysis result for SHA-256 88194d4ccf94f476…

MALICIOUS

PDF

133.3 KB Created: 2021-05-29 16:50:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 26a4316e84f5af68178ec332993a745c SHA-1: 1a443e0de27a0c4eb456c1e3b9ffbfcb3c018fa6 SHA-256: 88194d4ccf94f476f47ffff68d4eb34d79946981d1dc4deb5811e3fd874ded2a
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9800

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=life+application+study+bible+nlt+pdf+free+download PDF link annotation
    • https://rediwikutine.weebly.com/uploads/1/3/4/0/134096605/622244.pdfIn PDF document text
    • https://liguroxuf.weebly.com/uploads/1/3/4/4/134443360/0b89182edc97.pdfIn PDF document text
    • https://zezuwosizu.weebly.com/uploads/1/3/4/4/134459619/gosifekaxib_mokinelaxa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • https://uploads.strikinglycdn.com/files/55a9b624-524c-4766-91ef-e131be67e259/how_long_does_it_take_to_process_i_130_for_sister.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6e4e90b-9e5c-4d89-824e-84913d146f77/25218339252.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8411a446-cabc-412c-ba61-038ae1d0d292/94283863035.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9afe9671-298a-4f15-bd56-0291adff05bf/brambach_baby_grand_piano_weight.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16d346de-b297-474a-bebd-7563f0a87902/92013948429.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d36a86a-dd93-4215-b1c3-550e89fd9bb8/how_to_set_a_total_line_thermostat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4db1d568-f39a-4960-bc02-4773cab81b0a/mupujitudar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2c08101-0887-455a-82b6-0d71864dfed6/big_green_egg_electric_charcoal_igniter.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b29d235a-0c9e-4286-b31e-163953d379d1/nokederinuvomoxawuk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68de3bb1-71da-4fc9-8f05-ce04b0c126d0/rutoxazogonugatag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c61d2cc-a4e4-40e6-b6e1-3c9a04fe6f38/holiday_math_puzzles_middle_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81c7a8e5-d9d1-40ea-a3b6-ff64c67cffd6/what_is_jeppesen_airway_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa41d517-e3a2-4c79-931f-881aae9f9e86/why_is_nancy_drew_not_on_netflix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bed1860-07d1-404e-8655-e9c6eff5ae60/subject_verb_agreement_quiz_for_class_6.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/15465232-b3f9-4a74-a037-be9288e718b4/what_is_the_supreme_mathematics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec403655-f9b0-45ea-9020-b7606f56bb85/witcher_2_mods_nexus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d9b4255-7565-4094-9e70-d9f476a9bb2f/50101594646.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off0001d532.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D532 18256 bytes
SHA-256: 22785067a9038aceb99e262916d121f926cea4a027951bed4a3821e883a8bef0
font_00_sfnt_off0001255c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1255C 7444 bytes
SHA-256: 92c53f9a80a9bb6dbb692f1d829d12b86f991f217f16c4ed3f67fc1d3212d485
font_01_sfnt_off0001384d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1384D 6224 bytes
SHA-256: fd6b6f38b82485d37a73951acc9bc1f8247b39508af7cce15c00252a17d768b8
font_02_sfnt_off00014da2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14DA2 5424 bytes
SHA-256: c33e8900a373f5c0513b3cc9aa57dc92a2185bb33cecc624554f59cf58bbe2e2
font_03_sfnt_off0001603a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1603A 21192 bytes
SHA-256: b9e023269a0a992ec0e34eac28afe7569e5f8aebf0e637c3828735a991c89fec
font_04_sfnt_off000180d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x180D8 6348 bytes
SHA-256: b3018c04c4520583d0b3fd846815a5d0ccbad4b259201ae064e9d86d9e75c898
font_05_sfnt_off0001903e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1903E 1656 bytes
SHA-256: 23b8bff2acc89e6d1aa66a5c31e0db195a1cbdb7017254aaf6911e51cac122b8
font_06_sfnt_off0001989a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1989A 19348 bytes
SHA-256: 6f7f1bd91bdb1dc4559f3ee16ec8e18ef79a0679a3ee4e455bedee46990af7f6
font_08_sfnt_off0001f29d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F29D 6356 bytes
SHA-256: a7bdac457e65dd0bc4277e95575d1d65d72e3d20574a5678da9d76521ce6050b

Open this report in the interactive analyzer, or submit your own file for analysis.