Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6555d48cfa68e4d…

MALICIOUS

PDF

125.4 KB Created: 2021-06-09 21:27:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 1041b62dae1034eea69d7c21663024c7 SHA-1: 685a38a4ffc9404fc2476906f8b6072b7008aacf SHA-256: b6555d48cfa68e4d6fb28f2370dbcb2c5165e07ba6d166a51bc0aaddbe11597e
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO abuse. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and numerous external URLs point towards an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/pbw?utm_term=shaadi+mein+zaroor+aana+movie+download+link PDF link annotation
    • https://xiwitewikilimav.weebly.com/uploads/1/3/4/3/134371529/1424799.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427809/normal_6061e5690182e.pdfIn PDF document text
    • https://kavejujutafen.weebly.com/uploads/1/3/6/0/136022690/kowezukobef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368235/normal_604e0bb4d1463.pdfIn PDF document text
    • https://piriwunetu.weebly.com/uploads/1/3/1/3/131379541/4436256.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446270/normal_5ff885880dfdd.pdfIn PDF document text
    • https://tesomibafakaxag.weebly.com/uploads/1/3/4/3/134368706/namudixirude_bakedurugedaju_witobebij.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4493917/normal_60075a5cb0372.pdfIn PDF document text
    • https://mipijipibax.weebly.com/uploads/1/3/4/8/134873473/856383b8c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460946/normal_603c132c7d1c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418381/normal_6025b6585429d.pdfIn PDF document text
    • https://vugalemudapitos.weebly.com/uploads/1/3/1/1/131164275/lemababonarufopudo.pdfIn PDF document text
    • https://xorexataziz.weebly.com/uploads/1/3/4/4/134496469/8005955.pdfIn PDF document text
    • https://dalideno.weebly.com/uploads/1/3/5/3/135384103/vaxasasepaguniwi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376606/normal_5fda7aa5a8065.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374984/normal_606e8fc17de96.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495855/normal_6068c7b52d510.pdfIn PDF document text
    • https://xojurumute.weebly.com/uploads/1/3/5/3/135328527/dafexinod-tizotugesaridi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/648e8e2c-37c6-4361-a425-01eeeb3e59e2/78334087039.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea3ae65c-f538-46f5-897c-9c9c909b0166/how_do_dolphins_help_the_military.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9dee036b-b919-43f5-b8ac-1f0ecb7902a2/matlab_plot_markers_colors.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7351ee9c-de64-4294-818f-e9af14f0dcb5/18518880210.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5b68163-0e4d-42e2-9c2c-b46a87ca9947/tiwunexi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42dc2a20-25c8-4e1f-bef4-61d2777979f0/josasugubolefolesidizoza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a9a94f5-31ec-4127-9188-a97a257ab420/lopad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/405a2e2b-e1bc-4b13-95fb-e574c124c963/jepononejo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016aae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16AAE 3212 bytes
SHA-256: d080f092faf8a8f700809f574c724bd85eb61b0d38901eb685637b0059736c94
font_01_sfnt_off0001762e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1762E 5256 bytes
SHA-256: d4b866f7181e3a42af07c7c5870f427cd5cfdbd8475ecb0101e16a9930cb641b
font_02_sfnt_off000187fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x187FC 14184 bytes
SHA-256: 939313f57f72da50ab0d52e32824865cecbf699658e0b5dd7521910b6b639d0a
font_03_sfnt_off0001b59f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B59F 16480 bytes
SHA-256: 76568c54c46ed11f5c69bea8601283607f04b8e0e4e2332216aadf5664bd84a2
font_04_sfnt_off0001cc37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CC37 7608 bytes
SHA-256: ebe9cca3073b95d98bfcb36b576085b6d0e57d477ff093d50becb96886f916b2

Open this report in the interactive analyzer, or submit your own file for analysis.