Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bc8b9266eed0332…

MALICIOUS

PDF

83.9 KB Created: 2021-03-05 17:45:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: b96372b42e95929d3f607b94e52b0bf2 SHA-1: 5e1911b75fd456bbf67760828a1b9e86c31d331f SHA-256: 8bc8b9266eed03323491036f7df6dc0b88d1de7f1e611bae20d59ee119fe4465
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses an urgency-based lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=blaze+wizard+3rd+job+advancement+guide PDF link annotation
    • http://djami.ru/menusuzesijanuva09gtb.pdfIn PDF document text
    • http://br1.red/3745349588ic46k.pdfIn PDF document text
    • http://ultra0.space/1668852081dbanq.pdfIn PDF document text
    • http://rajajime.mypressonline.com/litidokojugozagowi.pdfIn PDF document text
    • http://fitit.space/757331862241egl.pdfIn PDF document text
    • https://wixevilit.weebly.com/uploads/1/3/4/8/134873569/pazon_redidafebojag.pdfIn PDF document text
    • http://bravos-kids.ru/95808838391rhgsk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412767/normal_600a4e5d7f57b.pdfIn PDF document text
    • https://fuvapevamasazu.weebly.com/uploads/1/3/4/5/134507747/xejed_xozigofijuji_lusufowipojaz_jarefudutut.pdfIn PDF document text
    • http://lenuvivureropi.scienceontheweb.net/8035307516.pdfIn PDF document text
    • http://drilltech.info/94908034149qxopt.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383929/normal_5ff522fb696c7.pdfIn PDF document text
    • https://lifezudo.weebly.com/uploads/1/3/0/7/130739479/f9e222f2.pdfIn PDF document text
    • http://najetaxu.mygamesonline.org/15361745672.pdfIn PDF document text
    • http://bagerisevi.scienceontheweb.net/xetipujujuwevurazuges.pdfIn PDF document text
    • http://fukerijinexin.mygamesonline.org/is_it_safe_to_use_a_mattress_in_a_pack_n_play.pdfIn PDF document text
    • http://jalazekesofijot.medianewsonline.com/nijorusutikujudezi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487416/normal_5fd994fc1b7e7.pdfIn PDF document text
    • http://kosonetibekub.medianewsonline.com/sivipitabikunitokedorali.pdfIn PDF document text
    • http://lnstagramsupportingcenter.com/how_to_set_time_on_la_crosse_technology6zkgw.pdfIn PDF document text
    • http://imedo.ru/57289136985iqsm7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465694/normal_5fe0356c5ec3f.pdfIn PDF document text
    • https://pefodiral.weebly.com/uploads/1/3/4/4/134476409/9377154.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wutejaxevewef.myartsonline.com/sakusijenutavoka.pdfIn PDF document text
    • http://nimanexobubibub.onlinewebshop.net/dizubezoterawa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A99 5712 bytes
SHA-256: 218205d1bc7df2817ff2d9647d7c434d9e75ac0e2b45b7828b260e1fc8c1691b
font_01_sfnt_off00011e1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E1C 10472 bytes
SHA-256: ceefecbcbba48e59142ef33de95dbf2ed9ced976c4cbf2a1d2cf210e7cc485df

Open this report in the interactive analyzer, or submit your own file for analysis.