Malicious PDF — malware analysis report

Static analysis result for SHA-256 b25d3782941ab996…

MALICIOUS

PDF

72.9 KB Created: 2021-03-23 12:46:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: e95921ca7991f2e89dd486bbee3f1cec SHA-1: 149c7dacaf0b3ac40a8b67a3f915f40a74d35a0e SHA-256: b25d3782941ab9969aecbf78cd6a8d0f4dd46437999c9c38f5367fdb2252a3c9
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=amarilli+mia+bella+pdf+g+minor PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4391636/normal_5fecf97964a20.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458622/normal_6011ce4c2a44d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476273/normal_6035b95f15d83.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465539/normal_60300af549201.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472774/normal_604ae688ddc5f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489404/normal_6052e46a93b36.pdfIn PDF document text
    • http://xonitaj.mywebcommunity.org/15849523517.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419849/normal_6014ba725921b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454541/normal_603e7e6992ba5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f792310c-efc1-4d61-8407-579c508f2432/what_food_is_good_for_menstrual_pain.pdfIn PDF document text
    • http://dowinoxerirud.epizy.com/fluid_mechanics_equation_sheet.pdfIn PDF document text
    • http://zezatiwo.epizy.com/xitibu.pdfIn PDF document text
    • http://gevorewububew.epizy.com/jakedekavasobatumedo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d997df4d-6d24-426c-add5-d36c575f060b/what_does_mundo_mean_in_other_languages.pdfIn PDF document text
    • http://joxopup.epizy.com/bloom_s_taxonomy_revised_2020.pdfIn PDF document text
    • http://zenomidesedi.rf.gd/class_11_math_book_bangla.pdfIn PDF document text
    • http://velelakolifuvu.onlinewebshop.net/bods_interview_questions_and_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2bb608f-2995-46e9-98e4-fcca200c15c3/how_to_produce_music_for_beginners_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0fb67c4-4349-4bbf-9297-46e41cae1623/how_much_do_cashiers_at_lowes_make.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7dbdcc6-3dfe-488a-99d7-e5fe9b0b6834/zananowegafilido.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9270573f-a839-47fd-92f1-342f51547197/how_to_consume_soap_webservice_in_java_without_wsdl.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19f44105-e90a-435f-a7f7-3a36c24301fd/age_of_heroes_hesiod.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e075.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE075 5312 bytes
SHA-256: 3bcfbadad1e6c3c0a95498ba46bece70dfb23ee250481cbd43c87e8217639f04
font_01_sfnt_off0000f267.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF267 10560 bytes
SHA-256: cadc3c5a1919ff24f6dcbb2059518d401b08c37184efa593e4eac2faed670acd

Open this report in the interactive analyzer, or submit your own file for analysis.