Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f9bbacb72197d47…

MALICIOUS

PDF

80.9 KB Created: 2021-03-14 11:23:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 6e0954df5ebbfd17b73a278ab4a6fa18 SHA-1: 9d2910c06f45763ec9be764b7205ab27a39976c5 SHA-256: 9f9bbacb72197d47449f1a70cb9a2ffdfd03cf051297735b04ce5ce5c549155d
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=canon+pixma+mp250+series+printer+driver+free+download PDF link annotation
    • http://lexanizisujufum.66ghz.com/yellowstone_park_wolf_update_answers.pdfIn PDF document text
    • http://oneitstore.pro/7636868495w3eab.pdfIn PDF document text
    • http://detonic-official.website/51280710336tqzgn.pdfIn PDF document text
    • http://fojefefipo.22web.org/nukesa.pdfIn PDF document text
    • http://davupopebuwiser.sportsontheweb.net/sex_drugs_and_cocoa_puffs_by_chuck_klosterman.pdfIn PDF document text
    • http://oneitstore.pro/what_is_a_scientific_paper_format8gdmj.pdfIn PDF document text
    • http://harmony-market.ru/plantronics_co52_manualzgcf0.pdfIn PDF document text
    • http://zumekina.22web.org/notigawupejedujuzuku.pdfIn PDF document text
    • http://xojuxelase.medianewsonline.com/49506008314.pdfIn PDF document text
    • http://verifybadgehelp.com/11432920312hrq0b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://ad843f61-c544-48d7-8cfb-3c048b9edb46.filesusr.com/ugd/0dd9ed_c23908993d4243c5a971e89849691ccc.pdf?index=trueIn PDF document text
    • http://mapumitowa.rf.gd/biblical_significance_of_the_number_803.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54c80ea3-05e2-4d8d-bf69-846cf615fd26/zopugutikago.pdfIn PDF document text
    • https://s3.amazonaws.com/kexamoxusinixu/understanding_the_linux_kernel_github.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ea1b78e-96a6-4c93-8abe-d6d4512cd66a/97580276583.pdfIn PDF document text
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_a50d7ff59be34477a114e216923b1d78.pdf?index=trueIn PDF document text
    • http://famomijis.onlinewebshop.net/apics_certification.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dfd923d-8d79-41af-87e0-a37fbfe6fb29/blacks_law_dictionary_definition_of_good_faith.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/premarital_counseling_certificate_of_completion_template.pdfIn PDF document text
    • https://f0ddeb88-3549-4a27-8821-6e3dd713f165.filesusr.com/ugd/2b74da_2a0df9173bb646eba0ecedb4569e55ce.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/baxunaf/street_view_google_maps_android_como_usar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eff4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFF4 5616 bytes
SHA-256: 425b72cea6d5585e6dd860a4313b1450062f4066ab60b72a665bc0777039421a
font_01_sfnt_off00010310.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10310 10668 bytes
SHA-256: 2633b728d0d2656af5260144437eb5ab442c72984f5883e433db7f9a1c4dd3d6
font_02_sfnt_off00012798.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12798 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.