Malicious PDF — malware analysis report

Static analysis result for SHA-256 94c8e5e3657aabf3…

MALICIOUS

PDF

90.0 KB Created: 2021-03-19 12:18:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: b512b64632a6a7fbc5802864101cf019 SHA-1: 291479a0f77958e5942525c9075d5b8ecc40cd0c SHA-256: 94c8e5e3657aabf3d4c0fb462ea5eb6c139e467c599cbea8bb96f2cba4568eff
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous embedded URLs, with at least one pointing to a domain associated with link farming and disposable hosting, suggesting a malicious intent to redirect users. The document body, though heavily obfuscated, appears to be related to 'ev3 line follower robot building instructions', serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9947

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=ev3+line+follower+robot+building+instructions PDF link annotation
    • http://gojovujewinunuj.mygamesonline.org/calendar_2020_indonesia.pdfIn PDF document text
    • http://xoxosedefoxadu.mygamesonline.org/figimorixafeduzuronetofi.pdfIn PDF document text
    • http://steblin.pro/741466877623v3mi.pdfIn PDF document text
    • http://digosige.mywebcommunity.org/munatunetejipoxared.pdfIn PDF document text
    • http://navalny.design/96846976945tbbim.pdfIn PDF document text
    • http://kujamemapevubu.mypressonline.com/multivariate_linear_regression_python_sklearn.pdfIn PDF document text
    • http://fartook.online/278973650476gm4u.pdfIn PDF document text
    • http://mojenisijita.mywebcommunity.org/tutinizibiponexusifek.pdfIn PDF document text
    • http://tosefabebiribow.scienceontheweb.net/acer_h236hl_specs_hz.pdfIn PDF document text
    • http://topstop.site/bob_dylan_songs_lyrics1l8io.pdfIn PDF document text
    • http://apkweb.net/rovokumegamjcuk.pdfIn PDF document text
    • http://sufofure.mywebcommunity.org/xewoparovajuxuwux.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://belibivizonojo.myartsonline.com/91062559855.pdfIn PDF document text
    • https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_ff3d6ccbd9bb465f9e77f0cfcb211e09.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a9fd163-3525-4b43-b5f2-bbb909a895a4/seiko_chronograph_7t62_price.pdfIn PDF document text
    • http://wufikemofumop.atwebpages.com/lobanuxi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0710244a-c4ce-47f7-bf28-11e558aa97f8/gurelufif.pdfIn PDF document text
    • https://3a0d5408-2ea1-4258-8d29-5d96341cad2c.filesusr.com/ugd/79cb75_9db4e1988f5545c1b937579085086a1d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/adobe_dreamweaver_cs6_trial.pdfIn PDF document text
    • https://c788b29d-df2d-4d46-9946-349e8cce89b7.filesusr.com/ugd/a9e086_b9347d6386024de190b4c9cd7f253d45.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6f7973a-96d1-494f-8aab-d744ee7486d8/gypsy_moth_caterpillar_treatment.pdfIn PDF document text
    • https://s3.amazonaws.com/tokudapele/3036277291.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc0e3cec-ab6f-4462-b49a-9d4a2594cd73/league_of_legends_update_patch_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/jenisozazewubo/bpo_full_form_and_meaning_in_marathi.pdfIn PDF document text
    • https://s3.amazonaws.com/vabemavuputenif/texto_argumentativo_y_expositivo.pdfIn PDF document text
    • https://05b56818-8b0b-4484-a411-4f1234233f1c.filesusr.com/ugd/e49726_65e8d9c77b404da8815f5fc20163545b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/19cbe4d4-1570-42ab-94fc-11857f3566ac/how_much_does_it_cost_to_add_a_dvr_to_xfinity.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011106.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11106 5276 bytes
SHA-256: 32254af207c57f4ca3595b66848e2f9cc424de6acfa6d185468b4a05ea16bddb
font_01_sfnt_off0001231f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1231F 11920 bytes
SHA-256: abbfb4765194459facacc3e9a9225a28ace257e2c012e8c90e7a8aa1b5fdb297
font_02_sfnt_off00014b65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B65 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.