Malicious PDF — malware analysis report

Static analysis result for SHA-256 948107fc9f67fd10…

MALICIOUS

PDF

144.4 KB Created: 2021-03-30 14:09:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2626c9c8ba2ec770a3dfe544982f464b SHA-1: 9b2b7e0fba8ff442a81c371e0fa9756bed59012f SHA-256: 948107fc9f67fd101526b5fe49703b9e6dcfc2dfe4c3c50227382b0e71f25024
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9341

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=shiva+namakam+chamakam+telugu+pdf PDF link annotation
    • https://joxunirefebemi.weebly.com/uploads/1/3/4/3/134319414/8309019.pdfIn PDF document text
    • http://businesshelpservice.com/xopimo8h745.pdfIn PDF document text
    • https://zisetilu.weebly.com/uploads/1/3/1/3/131382786/4005665.pdfIn PDF document text
    • https://kotezoxeruv.weebly.com/uploads/1/3/5/3/135345651/woxapawapetodeva.pdfIn PDF document text
    • http://wrinklestiltskin.com/867181740363qk2r.pdfIn PDF document text
    • https://kodepifaz.weebly.com/uploads/1/3/4/7/134705681/zujuzogi.pdfIn PDF document text
    • http://buyervannakupitvsem.xyz/samsung_remote_pairing_says_not_available0aaay.pdfIn PDF document text
    • http://fikepoj.22web.org/5-1_practice_polynomial_functions_form_g_answer_key.pdfIn PDF document text
    • http://dfds.in/proof_by_david_auburn5e0af.pdfIn PDF document text
    • https://budigalaxob.weebly.com/uploads/1/3/5/3/135313384/zusefobelitalo_rokerovolezib_dopakelepi_lowoleduwigofa.pdfIn PDF document text
    • http://winoorama.fun/ar_15_banned_for_hunting55btn.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/79d4dcdb-188e-456d-8c99-84791b39c4e7/common_irregular_verbs_spanish_present_tense.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77d8bab0-f869-4cd8-81f9-f8a66be68fb3/rurewokifukozivar.pdfIn PDF document text
    • https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_334011eb084849e6b9ca17ed71f254ad.pdf?index=trueIn PDF document text
    • http://sajojuwew.rf.gd/8260010839.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce2611ce-7451-4dea-a935-cbb5b20338b2/samezuru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb410f34-7604-46f4-9da0-f88200f66a9e/camp_half_blood_confidential_free_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a46a6c43-a9e9-4433-a3ec-d0087e6f3519/komutitilutulowob.pdfIn PDF document text
    • https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_4812e23ca55844a9abbd7c68f47902b0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c516b57d-519e-4f52-9873-44ec3a6ff4aa/machine_learning_tom_m_mitchell_solution_manual.pdfIn PDF document text
    • https://2b01876c-5741-4e94-bfb6-30973e4a6517.filesusr.com/ugd/45d688_0b50efc96bb34b12abb46e98def9073b.pdf?index=trueIn PDF document text
    • https://1628ddcf-e301-416d-9649-d9339b85441b.filesusr.com/ugd/0b1079_7580c3f1d4f44458980efffe98c60ae8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/237c0c44-db1d-4fe8-be53-55b53cec1277/it_stephen_king_actors_2017.pdfIn PDF document text
    • http://lanakupi.epizy.com/74506520209.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014f9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14F9E 5292 bytes
SHA-256: dd06adfbc71a99276b33c656b4f3a1a7c3415ede40f05e2f05f095178453b27f
font_01_sfnt_off00016170.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16170 3772 bytes
SHA-256: 9389eabb5da0f7ff5893e499ff791b47d46466a46589dcf6e6727fbd9e34bd63
font_02_sfnt_off00016d14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16D14 62124 bytes
SHA-256: 14511cd8392016a60893e9697c5ab174460385835e39f79ed90f05c89e1cdd0f
font_03_sfnt_off0001dcb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1DCB1 11064 bytes
SHA-256: 7171bc5117fc47d23c7ab808865e8154611b9a5fc702ba7709423619ffdb24f0
font_04_sfnt_off000201bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x201BD 16060 bytes
SHA-256: 99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953
font_05_sfnt_off00021657.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21657 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176
font_06_sfnt_off00022456.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22456 3588 bytes
SHA-256: ef50acc5daf098cb37d9d63f72c0aed44149a5ab5c33be5bb45ad2bc826f0083

Open this report in the interactive analyzer, or submit your own file for analysis.