Malicious PDF — malware analysis report

Static analysis result for SHA-256 a82b63f6c54ba5e4…

MALICIOUS

PDF

72.0 KB Created: 2021-04-16 12:17:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 6bcc10a8337843654b1680ece5f9aba3 SHA-1: 165b7064516ef580be51ebac1739d354469df357 SHA-256: a82b63f6c54ba5e4eeaf8f8a2d32c944d7a81062aab5212903ba0954f5ab38a1
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=philips+norelco+series+9000+trimmer PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4384029/normal_6006ef7131ac0.pdfIn PDF document text
    • http://safijejog.mygamesonline.org/68190021722.pdfIn PDF document text
    • http://ronifibofizet.medianewsonline.com/42654736679.pdfIn PDF document text
    • http://zugasanuko.getenjoyment.net/xiwenopimirap.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374537/normal_6023788a9d32a.pdfIn PDF document text
    • http://medazuxa.mywebcommunity.org/chaitanya_charan_das_books.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368266/normal_5fc6c5ea4c770.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450003/normal_605f4e7ec55ec.pdfIn PDF document text
    • http://dusikazo.mypressonline.com/11853270202.pdfIn PDF document text
    • http://vuvulusigi.scienceontheweb.net/bacaan_sholat_sesuai_sunnah.pdfIn PDF document text
    • http://rewetuxavix.mypressonline.com/consequentialist_ethics.pdfIn PDF document text
    • http://junumidutuzakox.getenjoyment.net/vevuretobesigi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://460eb545-5389-4aa9-9e78-d1074a8bca0c.filesusr.com/ugd/21a131_9487075fbc8a420fb780b51ea476e4ad.pdf?index=trueIn PDF document text
    • https://9539e3d7-93ad-434a-85ac-22bd9bdb82bb.filesusr.com/ugd/df7b34_286ed13a7532484e88f82f9badd94b03.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1b65498-0f4c-4f0b-9e36-94e36d36cdea/how_do_i_update_my_mac_from_10.11_6_to_10.12.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ed98f5c-f2dd-41b6-87c5-2bc5d6e329ab/how_to_draw_manga_hands_for_beginners.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8990a60a-a007-4e54-b31c-ed578cde1a8a/70262816224.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/093e47bc-3806-4be2-bb72-eaeccfa0a14b/19683456477.pdfIn PDF document text
    • https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_bbac4b0b5a204a3880fe6131e19d77ba.pdf?index=trueIn PDF document text
    • https://3cde87c3-25ab-478b-b58d-ba072f1c7540.filesusr.com/ugd/255d97_250f0588f2d249c8865babbb134577a9.pdf?index=trueIn PDF document text
    • http://mepitar.atwebpages.com/jirevogoferuvenojawu.pdfIn PDF document text
    • https://1a73feee-b327-4bc5-ac54-9d367b44a425.filesusr.com/ugd/226baa_0e66c05950504071a541b73e003603e2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dac6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAC6 5260 bytes
SHA-256: e9ef69af5da72b046c2211b4800889a75bacf41b1b4a7524e430c1b9b547e541
font_01_sfnt_off0000ec80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC80 11048 bytes
SHA-256: c0510b05a13463a2ec640633ee4ba21f6c32015474e8d784bf30c902ffe01288

Open this report in the interactive analyzer, or submit your own file for analysis.