Malicious PDF — malware analysis report

Static analysis result for SHA-256 8822f11ada0eda8e…

MALICIOUS

PDF

66.6 KB Created: 2021-05-09 06:47:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: ed105b82d4352363e3d1f02f23c4762e SHA-1: c6f680b4a1564a835800acde110d45609e139f3d SHA-256: 8822f11ada0eda8e912770d7571eb9f7b3699e6fad8095ff3f5dc919ff85bc2a
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=where+do+math+symbols+come+from+-+john+david+walters PDF link annotation
    • http://vudasuti.mygamesonline.org/puzetugemasobedebu.pdfIn PDF document text
    • https://mogarujatokeduw.weebly.com/uploads/1/3/5/3/135324664/vabefurin_fepefomubegife_kebotekufifi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370791/normal_60181a615661a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490516/normal_6064b55eb185d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409256/normal_606dd49d95e96.pdfIn PDF document text
    • http://busijizi.medianewsonline.com/pathogenicity_test_of_fungi.pdfIn PDF document text
    • http://ridaxaki.mywebcommunity.org/carnot_engine_efficiency_problem.pdfIn PDF document text
    • http://tefitagesev.mypressonline.com/lusemivegudakadadunutaxum.pdfIn PDF document text
    • https://metasabuvaro.weebly.com/uploads/1/3/2/6/132681671/487320.pdfIn PDF document text
    • https://jegivobepumo.weebly.com/uploads/1/3/4/4/134444156/totozuxapadigu_jokop_dojuruku_sorulawu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420588/normal_5fd7a339ca2ee.pdfIn PDF document text
    • https://vifojozajo.weebly.com/uploads/1/3/1/4/131454549/8854951.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/99042e01-82f4-48b4-b43f-73d001078736/vegos.pdfIn PDF document text
    • http://kubowulurarekij.myartsonline.com/riwasusogix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d97ef999-6502-4022-8d25-a3793a34b197/the_secrets_of_dance_music_production_-_attack_magazine_ebook.pdfIn PDF document text
    • http://sukokovevaz.atwebpages.com/iowa_boee_folder.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0daa4c8-87c6-4efa-946a-05464d20fb18/13027266607.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e52cab3a-4cf0-4c77-9530-03b1ac4f7d87/honda_6500_eu_generator_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e56fd241-7402-419d-a1f7-bc10f63e7ffc/4212848197.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6cdaac2-9a23-4ab5-8f51-72e461a82cca/literaburaw.pdfIn PDF document text
    • http://pimobepetokonud.myartsonline.com/zemageroxe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e67b1b2-3d1d-40fe-a37f-f703bffbaa4c/how_to_set_up_plantronics_headset_c054.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4CA 5776 bytes
SHA-256: bdcaf76565f6f9a1fca89111bf2a91b90c09fd81aadedb15b8de581b31027aaa

Open this report in the interactive analyzer, or submit your own file for analysis.