Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cd1504e37cbd857…

MALICIOUS

PDF

83.5 KB Created: 2021-06-03 20:49:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: c2d8417bed95164a43f562ba640c9bd1 SHA-1: 2299e57516f00b9c9c4d88e5e24750e82121f325 SHA-256: 8cd1504e37cbd857b8d0d280b29da3acf6e88cace26258b905d4f6cac14c989f
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains an embedded URL that mimics a search query, likely intended to trick users into visiting a malicious site. The PDF also functions as a link farm, with numerous external URIs pointing to various domains, further suggesting a phishing or malicious redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=can+i+use+face+sheet+mask+everyday PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4403804/normal_60325de2bc7ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476750/normal_5fe6492f3c2bb.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4481830/normal_60afe3ab55310.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vowujepojez.pbworks.com/w/file/fetch/144565887/pufaguvizedu.pdfIn PDF document text
    • http://xesimisejek.pbworks.com/w/file/fetch/144501432/12526699591.pdfIn PDF document text
    • http://mumasenekera.pbworks.com/f/tufuwoposela.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/938a97f9-4b5f-480e-96ba-2a83f25ecc4f/vehicle_air_conditioning_system.pdfIn PDF document text
    • http://finatin.pbworks.com/f/libimosovogeruz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51fa7ab8-9326-42c3-be05-e4642bbbe1c1/julius_caesar_act_3_scene_1_2_3_summary.pdfIn PDF document text
    • http://siruzosu.pbworks.com/f/where_can_i_buy_dog_food_for_cheaper.pdfIn PDF document text
    • http://detomipipu.pbworks.com/w/file/fetch/144509763/momekawisuvarar.pdfIn PDF document text
    • http://dekokos.pbworks.com/f/last_day_on_earth_hack_ios_2020.pdfIn PDF document text
    • http://jajisaparev.pbworks.com/w/file/fetch/144417720/monapabut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6dc8b40c-16ea-473a-b7c6-a833a50a3ee4/30253227733.pdfIn PDF document text
    • http://rugewenuzed.pbworks.com/w/file/fetch/144426525/minecraft_mc_heli_mod_1.12_2.pdfIn PDF document text
    • http://wuvebag.pbworks.com/w/file/fetch/144427794/wolole.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf11a1a9-273a-42ab-9cf0-6d9c72db7ee7/how_to_do_slope_intercept_form_perpendicular.pdfIn PDF document text
    • http://zorisomofi.pbworks.com/f/tokukivajajoba.pdfIn PDF document text
    • http://xuwuziz.pbworks.com/w/file/fetch/144558069/gukuzagegiwupajukegudola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89e78dfc-2e87-45e4-963e-c8dcba8c8ee7/26143071390.pdfIn PDF document text
    • http://jujupaw.pbworks.com/f/ielts_paper_based_exam_dates.pdfIn PDF document text
    • http://lekuzax.pbworks.com/f/34748203989.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010930.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10930 5360 bytes
SHA-256: 1e3c3c6773a48d70089d494290d92d489507a351e49255fc25133ce88379ce58
font_01_sfnt_off00011b4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B4B 10896 bytes
SHA-256: 9d886acad87debbfbf6ffd774b944adca4ac825a44156a9b4552caa6896c10ad

Open this report in the interactive analyzer, or submit your own file for analysis.