Malicious PDF — malware analysis report

Static analysis result for SHA-256 a29cd16bb5491c78…

MALICIOUS

PDF

87.5 KB Created: 2021-04-16 12:16:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: b77333d571ecf53d3939c4761426bdaf SHA-1: da03ae443125564ed290002ea1587d5506339ac0 SHA-256: a29cd16bb5491c783ccbf864997d76c512b4adf766cac01270f8afe98c4e7769
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO spam or phishing. The 'SE_ADVANCE_FEE_SCAM_LURE' heuristic strongly indicates a scam involving fake prizes or parcels, aiming to trick users into clicking malicious links. The ML classifier and ClamAV detection further support its malicious nature. While no scripts were explicitly extracted, the PDF structure and heuristics point towards a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=sarah+plain+and+tall+trilogy+dvd+set PDF link annotation
    • http://paktum.pro/smith_s_pharmacy_hours_valle_verdevdp5g.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465704/normal_606730b5acde6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501029/normal_5fd2c7b6336e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454982/normal_603a0be7bfee5.pdfIn PDF document text
    • https://diwekivoveludu.weebly.com/uploads/1/3/5/3/135313391/wugikologajega.pdfIn PDF document text
    • https://fikozipe.weebly.com/uploads/1/3/4/8/134887908/48581b55937.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458628/normal_6041de828651e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368954/normal_603238883ff48.pdfIn PDF document text
    • http://chambrehub.xyz/706978956086je2c.pdfIn PDF document text
    • https://zupavuzinopaz.weebly.com/uploads/1/3/4/2/134265708/nelulek.pdfIn PDF document text
    • http://dkblogin-de.com/100_deadly_skills_survival_edition_free0vnpu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390660/normal_5ffd63f7d11e5.pdfIn PDF document text
    • https://vafunaparixidi.weebly.com/uploads/1/3/4/6/134627598/nejoxigopu_mubejefuzo_nanumi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485448/normal_6026e059b16df.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dudurat/android_vs_ios_market_share_united_states.pdfIn PDF document text
    • https://s3.amazonaws.com/rujabepifar/differential_equations_series_solution_calculator.pdfIn PDF document text
    • https://s3.amazonaws.com/jewizopukuni/62713340964.pdfIn PDF document text
    • https://s3.amazonaws.com/ronatiduzoxij/does_adobe_premiere_pro_cost_money.pdfIn PDF document text
    • https://s3.amazonaws.com/lomiwexuva/how_to_manual_muscle_test_piriformis.pdfIn PDF document text
    • https://s3.amazonaws.com/gifiz/sql_query_from_excel_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/xarojapi/30585691974.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010dea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DEA 5488 bytes
SHA-256: 22abaf8dbe31835f26719e4a7c0637b1a6d7a7c54b1f15cda353c45b9b786459
font_01_sfnt_off00012092.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12092 14568 bytes
SHA-256: 76d1fa97221517c5fbedecdacf2fa0f2dce30bd03d2bc81f5832baf6bb430ef5

Open this report in the interactive analyzer, or submit your own file for analysis.