Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b47ee7ce50fab48…

MALICIOUS

PDF

90.8 KB Created: 2021-05-31 16:01:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: bb21855131c10fac7ae0d5f203e634a5 SHA-1: 85ab27eefef15e60c55f756854aea833f959848c SHA-256: 9b47ee7ce50fab4841c7744858bba29695b848eb34d3d9886b0c04b1da830c3d
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, with one pointing to 'gimoguvi.ru', suggesting a link farm or redirection to a malicious site. The document body, though partially corrupted, contains keywords related to 'dengue fever guidelines', likely a lure to encourage users to click the embedded malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=dengue+fever+latest+guidelines+2019 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4451753/normal_600d44bb8ad08.pdfIn PDF document text
    • https://manoxumumaxu.weebly.com/uploads/1/3/4/4/134472756/juxujatuzutis_juzumixa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415291/normal_600abac5e5deb.pdfIn PDF document text
    • https://fipoxojumudex.weebly.com/uploads/1/3/4/6/134649093/mifibutugol_kafevofitirivo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408340/normal_6045fccdc2bc7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415055/normal_5fd17f485c9ef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476590/normal_600cf4ade475b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453747/normal_5ff239dc3f48c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467571/normal_6018e00237681.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404750/normal_6049469a44731.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393044/normal_5fd2cb487bc93.pdfIn PDF document text
    • https://pudajokorafub.weebly.com/uploads/1/3/7/5/137516447/penisibevovatiw.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/4844b4b6-06da-4a7d-949d-74722407298b/48580990257.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9013f32-3d74-4bd8-8589-b8f857e482dc/mamakiwus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae4c998c-d6f2-4b43-8aa2-9997e3e5c5b7/how_to_download_and_install_vidmate_app.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cb54287-0b22-4279-87a4-900ae391dcdc/what_are_the_characteristics_of_child_initiated_play.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc9513d0-af7c-47a2-90fd-76712c649d48/que_es_una_propuesta_teorica_metodologica.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47ad6ce9-56a6-48b5-9046-72decaabbb63/pikaga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac0dd5b7-d9ed-43dd-b76d-e2d80b8dae00/sisojorovidelepe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000116d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116D1 5388 bytes
SHA-256: e556b94beaeebcce5232ddd08447a56ff04849f884ef847215056461c8dd9034
font_01_sfnt_off0001293d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1293D 10960 bytes
SHA-256: 8a997d40a873dd69517a004c6a2d26922cdb79ca4ab6e48f989c768d3bfcad7b
font_02_sfnt_off00014d8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14D8C 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.