Malicious PDF — malware analysis report

Static analysis result for SHA-256 89cad69260669626…

MALICIOUS

PDF

84.0 KB Created: 2021-04-03 23:39:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 6a52e22fdf4fee2a911599474696d292 SHA-1: 53bc912876aa495500eb1a67e52526c0b1576e7c SHA-256: 89cad69260669626923d08608c854a1f82ab29e670a6504578ba002bd540a4ef
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=simplasto+e+apoplasto+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4420910/normal_6035f55923461.pdfIn PDF document text
    • http://mandarin-fruit.space/aurora_hdr_2018_crackgvdc5.pdfIn PDF document text
    • https://cdn.sqhk.co/noxisoture/Mg8ifij/can_you_escape_the_room_level_46.pdfIn PDF document text
    • http://love-cosmetics.shop/la_siesta_del_martes_english_summaryywpsr.pdfIn PDF document text
    • https://cdn.sqhk.co/sovokeduseb/V7MZlii/infection_prevention_and_control_action_plan.pdfIn PDF document text
    • https://cdn.sqhk.co/fezavomol/5jaKQ4p/lobotipajo.pdfIn PDF document text
    • https://cdn.sqhk.co/vuguvorexi/hgkichb/jaundice_ppt_free.pdfIn PDF document text
    • http://artyom.guru/public_relations_assistant_salary_nyc0lkby.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413575/normal_5fe5f8b17b180.pdfIn PDF document text
    • http://pozijuza.scienceontheweb.net/twilight_breaking_dawn_part_1_full_movie_download_in_tamil.pdfIn PDF document text
    • http://bikejesoxatelo.mygamesonline.org/34044517757.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480585/normal_6013899ad6f64.pdfIn PDF document text
    • http://generalmassage.online/how_to_prepare_construction_budgetaolip.pdfIn PDF document text
    • https://cdn.sqhk.co/wupifufexix/eUjWfhe/how_to_cook_pot_stickers_in_the_oven.pdfIn PDF document text
    • http://namsinc.info/ap_human_geography_chapter_12_test_answersyzsgf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://gosaduzunake.myartsonline.com/52607764816.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a03dbb30-cf8e-4a6c-8fb0-da2ff6fb4862/22374209939.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f968cde9-35a5-4491-b8c6-7b4de2c39c94/77949721392.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfffd798-da07-4d04-b8ba-5a3aecd9843e/vonuwigutenajuvegujo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23d5808e-51be-4176-afb7-63135f83f170/esl_placement_test.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C1B 5192 bytes
SHA-256: 7f0a34249386ebb7f425a80a0a6f5ac99f27528061b930f90e7b83695f7895d2
font_01_sfnt_off00011db0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11DB0 10864 bytes
SHA-256: 96e1af8a53c451dbb7d0a8c2ba726a4b01e7cb88f16fb7b8bd5a13f1137960b6

Open this report in the interactive analyzer, or submit your own file for analysis.