Malicious PDF — malware analysis report

Static analysis result for SHA-256 990d2c36a9e341a7…

MALICIOUS

PDF

68.1 KB Created: 2021-03-06 01:23:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 6913e039a370f1529958314affd66f1a SHA-1: 4c861b606334463b9f42cdfdb11b953d5fe6d5c1 SHA-256: 990d2c36a9e341a7b18926ef000d58b602282537029f7dd46d0d77966078c96d
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file contains a large number of external links, many hosted on disposable domains, characteristic of a link farm. The ClamAV detection and ML classifier indicate malicious intent, likely for SEO manipulation or to distribute further malicious content. The embedded URLs point to various domains, suggesting a broad distribution or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9417

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=is+a+water+flosser+better+than+interdental+brushes PDF link annotation
    • https://jepibuko.weebly.com/uploads/1/3/0/7/130739686/1584281.pdfIn PDF document text
    • https://cdn.sqhk.co/wozejodes/ja8iigc/one_clue_crossword_answers_chapter_3.pdfIn PDF document text
    • https://zepukuliro.weebly.com/uploads/1/3/5/9/135964459/nodetudakuwojin.pdfIn PDF document text
    • https://dugigoje.weebly.com/uploads/1/3/4/7/134754128/3db132597e.pdfIn PDF document text
    • https://zegesunipatobas.weebly.com/uploads/1/3/1/3/131379774/rawamotuxerekomugif.pdfIn PDF document text
    • http://pupezawat.scienceontheweb.net/74460928898.pdfIn PDF document text
    • https://fefejixoloxit.weebly.com/uploads/1/3/0/9/130969032/duzevodo.pdfIn PDF document text
    • http://gedadekenoz.mywebcommunity.org/how_much_do_warehouses_pay.pdfIn PDF document text
    • https://barurusijibipek.weebly.com/uploads/1/3/0/7/130740419/5492159.pdfIn PDF document text
    • https://dopakuxapat.weebly.com/uploads/1/3/4/8/134895633/raxowapegikibanof.pdfIn PDF document text
    • https://cdn.sqhk.co/balaragu/CYvCggi/hockey_stats_software.pdfIn PDF document text
    • https://cdn.sqhk.co/suwajipufo/a8jaBjb/38530453405.pdfIn PDF document text
    • https://duzuvopewawufos.weebly.com/uploads/1/3/4/4/134491429/5539c4a872.pdfIn PDF document text
    • http://rawoxaxevog.mygamesonline.org/kukumejorupiko.pdfIn PDF document text
    • https://cdn.sqhk.co/mazonixun/Dojghjb/bethesda_pinball_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/jezaziritav/rihhbaD/13463049519.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/feeebb2c-f9cb-460a-a44b-5a93de3469ed/how_to_create_a_toga_costume.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/12387204-b56f-4c4c-8529-082193e5bacc/43593081069.pdfIn PDF document text
    • https://s3.amazonaws.com/vebenok/vikuvad.pdfIn PDF document text
    • https://s3.amazonaws.com/bipovoromoj/2020_calendar_with_week_numbers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fbe2a5d-0b45-4eb4-bd33-9e17c1df7a1c/zowafuzarurasosedotefiliw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/996f4016-bbd8-4e9d-9bdf-8c94d7cff4d4/skyrim_mods_xbox_one_crashing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02762dbe-36b1-401e-a14e-65b265c1ab25/ziwipakaxarojageweleja.pdfIn PDF document text
    • http://xuvekixofeku.onlinewebshop.net/51534686835.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB75 5164 bytes
SHA-256: 6e35065ffad4eda8a92d24069bd35cd6932f568657695e3fc01f7da8a293ead6

Open this report in the interactive analyzer, or submit your own file for analysis.