Malicious PDF — malware analysis report

Static analysis result for SHA-256 937e87e680db57f9…

MALICIOUS

PDF

119.6 KB Created: 2020-11-20 00:19:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 2e75ba194cfd0a63f03e7a668cf91e63 SHA-1: e0f4d29f689f6d36813d1fa78b1ceceb545c9a92 SHA-256: 937e87e680db57f92e19011d61ae660e4e09b3912d23459fb096d352a34836bc
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with many URLs pointing to PDF files, suggesting an SEO manipulation or redirection scheme. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' confirm the attack pattern of directing users to external, potentially malicious, content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?utm_term=book+t+tarot PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4365567/normal_5f8d26ac14992.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382782/normal_5f911d8b6d73b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450257/normal_5f9f6d976ccbc.pdfIn PDF document text
    • https://womukowewefe.weebly.com/uploads/1/3/4/8/134889771/2cf69df4b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366969/normal_5fa1867208801.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373986/normal_5fb33660e2858.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465545/normal_5faf8647469c4.pdfIn PDF document text
    • https://xoxujodega.weebly.com/uploads/1/3/4/3/134363828/f5ea85f0cb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382789/normal_5f90fa272be0a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420235/normal_5fb6b93804da6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416923/normal_5fa6a65749f81.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368477/normal_5f91ad4c8bc48.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/juzinaramip/chp_cadet_study_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/believers_authority_study_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/dugibabafod/38576832150.pdfIn PDF document text
    • https://s3.amazonaws.com/bezutu/gang_violence_statistics_2017.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e65d87f7-c152-4083-afb2-1303c698f60c/saskia_laroo_body_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f486427c-0d2e-46c4-9ae9-a588cc8536a8/general_aptitude_questions_with_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019be9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19BE9 4580 bytes
SHA-256: 5dcc630267cea3335c52836ce2632be876691ef93472c7542d42c216f5cc3192
font_01_sfnt_off0001ab8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AB8F 11108 bytes
SHA-256: 4310f2a8fc432605a90c7579ba7f36c44349f237ff1d6094797753d00b1ff515

Open this report in the interactive analyzer, or submit your own file for analysis.