Malicious PDF — malware analysis report

Static analysis result for SHA-256 b32bc3fe20396f21…

MALICIOUS

PDF

76.2 KB Created: 2021-06-13 20:38:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: dd7d2723e9c224368ab9b8c2d7c236bf SHA-1: b717e84d9d76b276c2e589d8cee77670371d6497 SHA-256: b32bc3fe20396f2129249b188da3ba5462eaaeb6d998320d39f53ac2a2cd3bfa
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a large number of external links pointing to various domains, many of which appear to be disposable hosting services. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier further support its malicious nature, suggesting it may be a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8823

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crysiq.ru/pbw?utm_term=circumference+and+arc+length+worksheet PDF link annotation
    • https://buvapubadoloj.weebly.com/uploads/1/3/4/2/134265521/1290058.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370762/normal_600296c9be332.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462056/normal_6033c9ab86739.pdfIn PDF document text
    • https://zopofaxomape.weebly.com/uploads/1/3/4/3/134372760/8884468.pdfIn PDF document text
    • https://raxumizagava.weebly.com/uploads/1/3/4/7/134710615/fifitetiw-zuxixop-miwedezom-gajuzunuj.pdfIn PDF document text
    • https://xamuzufoka.weebly.com/uploads/1/3/4/8/134893590/pipaxixeluzo.pdfIn PDF document text
    • https://gufekibeliwu.weebly.com/uploads/1/3/1/3/131382841/vudog.pdfIn PDF document text
    • https://kesoxebexug.weebly.com/uploads/1/3/2/6/132681937/1eed2ce.pdfIn PDF document text
    • https://jevamupoledi.weebly.com/uploads/1/3/4/7/134712268/kusader-jinarunubafag-keboj.pdfIn PDF document text
    • https://zaxezoxixuj.weebly.com/uploads/1/3/6/0/136097133/8240855.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411915/normal_603c6438ba3c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463306/normal_606610429dc8d.pdfIn PDF document text
    • https://ragidogatekanex.weebly.com/uploads/1/3/4/3/134388076/43483.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc38ec74-7d5a-40cf-820d-7b2fe70b6973/lazarazew.pdfIn PDF document text
    • http://xovakovawup.pbworks.com/w/file/fetch/144944619/3ds_max_2018_crack_free_download.pdfIn PDF document text
    • http://funasazixi.pbworks.com/w/file/fetch/145034598/wifi_password_hack_online_without_root.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd5b0656-2e4b-40fa-8f34-b50c46efe041/algebraic_expressions_class_8_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec9b44c4-8189-417a-bbe1-700ac96c0e92/gutopabulukosa.pdfIn PDF document text
    • http://puzavofan.pbworks.com/f/rockstar_games_social_club_crew.pdfIn PDF document text
    • http://varulemenel.pbworks.com/w/file/fetch/144989868/80266849934.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010688.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10688 5496 bytes
SHA-256: e230338c2cf8157b943f2bd86cc3d0cb655cbad496572d6ab268d932dce12b97

Open this report in the interactive analyzer, or submit your own file for analysis.