Malicious PDF — malware analysis report

Static analysis result for SHA-256 b60538c32ecdabbe…

MALICIOUS

PDF

76.6 KB Created: 2021-04-09 04:18:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 840fa55f8fbc75c769717e361ce23851 SHA-1: 128ec91c4282f605e14ecc38f817b04ebbbe3e90 SHA-256: b60538c32ecdabbe849b06d45d3f76a226856fa88e8b00fb946f39ed4d57078c
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=how+to+use+iphone+as+webcam+for+mac PDF link annotation
    • https://petodudugagakot.weebly.com/uploads/1/3/4/6/134640630/jesobiv.pdfIn PDF document text
    • https://xupubiwe.weebly.com/uploads/1/3/4/3/134339906/2bdf2695.pdfIn PDF document text
    • https://juxeduwabup.weebly.com/uploads/1/3/0/7/130775558/1185368.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375339/normal_604bc2cf93867.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451018/normal_602305765149f.pdfIn PDF document text
    • https://vedudogekikusiw.weebly.com/uploads/1/3/1/1/131164168/powow-digeposesiku-rikotutupete-wovosiserulaw.pdfIn PDF document text
    • https://basafokadu.weebly.com/uploads/1/3/4/7/134706648/0f1f8cd55bea.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_d611c02927384f9e90163b154541ddfe.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rotowan/sajorepujanatebufivumo.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/accidents_reported_today_chicago.pdfIn PDF document text
    • https://s3.amazonaws.com/pigolo/what_are_the_origins_of_the_us_constitution.pdfIn PDF document text
    • http://toxuvadamutetix.rf.gd/nursery_rhymes_books.pdfIn PDF document text
    • https://s3.amazonaws.com/fovezewi/thinkpad_t430_hard_drive_replacement.pdfIn PDF document text
    • https://c4a0f302-b060-43a0-af10-a0364da5eca7.filesusr.com/ugd/c6d327_796e228a422441d489bc9f03eeebb711.pdf?index=trueIn PDF document text
    • https://a9750898-a066-404d-a796-54a2f5ad13bb.filesusr.com/ugd/60231a_ee5ed8d1e9da4898b47e790b1f2b7683.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zakunafu/lifting_equipment_register_example_sheets.pdfIn PDF document text
    • http://nusemid.rf.gd/sulosazodolazoxiwutik.pdfIn PDF document text
    • http://kamegowemegoguw.rf.gd/aws_certification_training_material.pdfIn PDF document text
    • https://c6926203-1eb9-401e-9afa-11f61f201807.filesusr.com/ugd/685707_03130327e7cf4183a8a1a1023259c056.pdf?index=trueIn PDF document text
    • http://kakonuragesati.rf.gd/ows_oxford_word_skills_basic.pdfIn PDF document text
    • https://s3.amazonaws.com/padosumifubobo/7.3_powerstroke_external_transmission_filter.pdfIn PDF document text
    • https://s3.amazonaws.com/zikeko/93331745160.pdfIn PDF document text
    • https://917ed8d3-8a9f-4c5c-a3ad-554e533308ad.filesusr.com/ugd/a4e402_a32084e070e14b9b9b3bfe1e7f4ff4cb.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF0C 5416 bytes
SHA-256: 934149d017029db6d6a443b4db4c0daf65eecc2a53e95a8abcba262b00c20aaf
font_01_sfnt_off0001015d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1015D 10428 bytes
SHA-256: ab6b9bd53601ac25747d7407f6350b73a70d496c74fa6d853ede46d22c0677d8

Open this report in the interactive analyzer, or submit your own file for analysis.