Malicious PDF — malware analysis report

Static analysis result for SHA-256 a49f1f510840c178…

MALICIOUS

PDF

84.4 KB Created: 2021-03-21 11:46:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: c964f5fa327ac0beace701b4edfe6dac SHA-1: 239d57056b7c6cc9b5b30b305bf5036ff89fdecf SHA-256: a49f1f510840c17836f0db6fe1875895062eb144cd1e3ce9fd7189c0c2f38f2e
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=how+much+mileage+does+yamaha+fz+gives PDF link annotation
    • http://juwupexutaval.mywebcommunity.org/nivarufedozuvop.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fatisake/7635835372.pdfIn PDF document text
    • http://pilejifizodan.onlinewebshop.net/zizikugodofumusiloviw.pdfIn PDF document text
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_ff6063c04d784b9aab775e77d8dbcc1a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/86599678-5eab-44cf-a6f7-7366638bef44/17_day_diet_cycle_1_dinner_ideas.pdfIn PDF document text
    • https://22449060-8e30-4723-8828-967625cce342.filesusr.com/ugd/eddc50_4d18b5378fa64a9f8d8b58362982ec72.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bab35d4a-6301-43f4-8ac1-a24190a41c24/technical_analysis_for_options_trading.pdfIn PDF document text
    • https://s3.amazonaws.com/zolerazowubow/dizajifajaj.pdfIn PDF document text
    • https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_0f45312c20d84f80a9dfaa0c9c4ee48b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac3620de-ae6b-482e-b03b-c936e306d451/pabufigebapiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cbf74a7-971b-4dbb-9e6f-0fec02122c05/how_to_take_apart_a_conair_hair_trimmer.pdfIn PDF document text
    • https://s3.amazonaws.com/xakusineba/mowetuzom.pdfIn PDF document text
    • https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_fd1059bfcc124f36883f0cd048238153.pdf?index=trueIn PDF document text
    • https://357b8bef-7330-4cfe-b31d-389db25c4d5a.filesusr.com/ugd/4c76bf_e4c5b3c1bff84ff9996a6173fe6eeca6.pdf?index=trueIn PDF document text
    • http://rorazizaxaf.atwebpages.com/99704473346.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/552a7153-f9c3-45ce-b8cf-34e799fedd4b/55446142067.pdfIn PDF document text
    • https://636e06b3-920c-4898-b827-ef778bbbc101.filesusr.com/ugd/40512e_af51cd6a0ab04c53b29cbc1594b70aed.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mutirexa/udi_rc_u818a_battery.pdfIn PDF document text
    • https://s3.amazonaws.com/xakajoziwibi/cuantos_medios_de_comunicacion_existen_en_la_actualidad.pdfIn PDF document text
    • https://s3.amazonaws.com/nevowimo/hansel_and_gretel_netflix_1987_cast.pdfIn PDF document text
    • https://409b2d23-5c1d-402e-97df-26c0da9299b0.filesusr.com/ugd/2e3d42_68cadb42ca5549a59ba68dbe1142ff18.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001089d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1089D 5604 bytes
SHA-256: f503674238b91f6cb1799488bed60df8ed48dd186dc335f3a8dc640cc90d9ef5
font_01_sfnt_off00011bb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BB1 11436 bytes
SHA-256: ab06b6ad0fdfe32afa4c9312d82440e712d053544edffdd5dbef22ce988bb41d

Open this report in the interactive analyzer, or submit your own file for analysis.