Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5fec15aa0f655b2…

MALICIOUS

PDF

80.7 KB Created: 2021-03-22 11:34:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 9db356a2dbf788badf174ad2775fb57c SHA-1: b081bed563cac7fc8f63e5d627088d19d8724762 SHA-256: b5fec15aa0f655b29b304de1392c3d18652aa8d578191e1f8e3f4f76a4a55f5d
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=actinomicosis+tratamiento+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4450519/normal_6032ca98e0767.pdfIn PDF document text
    • http://dobofozepop.mygamesonline.org/elementary_linear_algebra_a_matrix_approach_student_solution_manual.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468268/normal_600efaaa896b6.pdfIn PDF document text
    • https://nagiwudulowep.weebly.com/uploads/1/3/0/7/130775657/7839119.pdfIn PDF document text
    • https://vidiwubiref.weebly.com/uploads/1/3/0/8/130874646/6255389.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380695/normal_5fcdee4289259.pdfIn PDF document text
    • https://fidexirubopuzer.weebly.com/uploads/1/3/2/8/132815065/javoxe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405467/normal_5fe5d020876bd.pdfIn PDF document text
    • https://vakugisup.weebly.com/uploads/1/3/0/7/130739558/jegotofifanote_dolovuwodu_munovudat_zuxusog.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410016/normal_5fdba8bc7b7ad.pdfIn PDF document text
    • https://bolumuratojepo.weebly.com/uploads/1/3/4/7/134749128/8923784.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426087/normal_6004073e4a253.pdfIn PDF document text
    • https://gimoxawoja.weebly.com/uploads/1/3/1/3/131380550/bed1fa7ae9d57e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444626/normal_601afcb393f3b.pdfIn PDF document text
    • https://revegeworosopo.weebly.com/uploads/1/3/1/6/131637057/soxobexozilabel.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487888/normal_6053b4ba5c441.pdfIn PDF document text
    • http://wojesukuzak.mygamesonline.org/sharp_portable_air_conditioner_cv-p10rc_parts.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/965f6604-b87b-4dec-bd88-42a3efdf9876/36740787358.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eacb490b-4a06-498b-9a1b-aed354bd467c/hp_printer_c4580_print_cartridge_missing_or_not_detected.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8684bf2-e05f-4eda-ad29-7edd23718238/felekapavivamizeketewag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7dcd0a77-9947-478d-8282-adf238ccccb4/balonelexipokefasotim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04d39a4f-7373-44ec-b0ee-681d9da2be36/32890535234.pdfIn PDF document text
    • http://gozuketitara.onlinewebshop.net/8755657292.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC15 5260 bytes
SHA-256: 424e9d274ffca6c3faee081983de116c3d17d1e0dfead51ab0a82ac565b0daf1
font_01_sfnt_off00010de0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DE0 11696 bytes
SHA-256: 41a196c749b6c1980653cd13a573b06235e67a8c1d6782dfd454b9914ac1685c

Open this report in the interactive analyzer, or submit your own file for analysis.