Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8bb61f6c45e7549…

MALICIOUS

PDF

77.9 KB Created: 2021-03-21 06:53:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: b5cc255cce1a31fbbbcc633ba1358bd4 SHA-1: 7122126aa99fb4eb52b9b8bd1caaabeac6185e03 SHA-256: a8bb61f6c45e7549efeba2a85a1d56455de0a2e14ac86294ef74a2887e0bb716
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=dulux+high+gloss+paint+safety+data+sheet PDF link annotation
    • https://cdn.sqhk.co/ponesigis/2jaidSw/jozeradizukivumade.pdfIn PDF document text
    • https://cdn.sqhk.co/rojozedofaf/hagfqhh/happy_hill_race_game.pdfIn PDF document text
    • https://cdn.sqhk.co/numavagoko/ghhfsAt/sopezelapowusem.pdfIn PDF document text
    • https://cdn.sqhk.co/kisasizaro/m0iaidz/driving_school_classics_mod_apk_home.pdfIn PDF document text
    • https://cdn.sqhk.co/fuwunikuneg/ighhbgc/likert_questions_help_to.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wesezuzuvalirik/90665543334.pdfIn PDF document text
    • https://a6132035-7465-4fe4-be4e-2faa96c22dab.filesusr.com/ugd/cf950b_35af0ec7238f45328af500f4237d63f2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vesubodufisi/what_is_enthalpy_of_formation_of_a_compound.pdfIn PDF document text
    • https://d046670e-94b8-4ea2-8efc-69fca9b502c9.filesusr.com/ugd/c0b427_a7547bba0c814d90af98b76586d6f48f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fulosobezur/how_to_weld_with_a_lincoln_140.pdfIn PDF document text
    • https://1347de4c-4e54-429a-b84c-372e60bc5a2b.filesusr.com/ugd/6c98bc_36ee1c4639cf4c67bfa48e71a1e794ca.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e3b6b3a-500a-4c63-92b3-038d421d0d01/cuanto_es_un_decimetro_cuadrado_en_centimetros.pdfIn PDF document text
    • https://s3.amazonaws.com/regegozumekoza/xafaba.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d74638e-5b6a-4036-9fc0-1deccbf6fc16/53874056727.pdfIn PDF document text
    • https://a80c0318-1640-4d50-a016-df037fc402b9.filesusr.com/ugd/895bef_c47ffd99fa234a258eae3832cff22348.pdf?index=trueIn PDF document text
    • https://2daccc73-8708-4113-a26a-4f38906335d9.filesusr.com/ugd/f65175_eea88efb9ae142bca46d138ebaa2d378.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/visagogijulep/physically_fit_worksheet.pdfIn PDF document text
    • https://b9387e75-0942-48a6-8a47-0bd3f0224277.filesusr.com/ugd/fc485c_475f844a4dd64894a23d660b05e42767.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7C2 5256 bytes
SHA-256: 5251a4e8ffc6439966cd9982024c9d4fe1d91088c0ae0c506f275bb611cbf1cc
font_01_sfnt_off0000f9bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9BD 10084 bytes
SHA-256: 968031b0f8e9fa667fff6235987b424c20500bde74568127509cf0a632bec621
font_02_sfnt_off00011c2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C2F 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.