Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6913a901e649d22…

MALICIOUS

PDF

104.6 KB Created: 2021-03-23 03:50:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 49402030baf20136bd47285779dbd52c SHA-1: b2b5b0a9d9bcf71db07b6f91d23dcc8c2c11ede1 SHA-256: b6913a901e649d2254ca032a62e140c21c496fcf784b30b99c0fd99f0addab3a
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many pointing to disposable domains, suggesting a link farm or SEO spam operation. The ClamAV detection as 'Pdf.Phishing.Trojan' further indicates malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing or malicious redirection attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.1105

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=progressive+era+muckrakers+chart+answers PDF link annotation
    • https://mutomutozuso.weebly.com/uploads/1/3/0/8/130814133/xevedi_resakif.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413125/normal_600da4544b256.pdfIn PDF document text
    • http://pedufan.iblogger.org/togawumarilon.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367268/normal_5fd0e6cb0087f.pdfIn PDF document text
    • https://waporutonopira.weebly.com/uploads/1/3/1/4/131438234/xaguridodi-rezapa-vubeximipu-mumijofeviru.pdfIn PDF document text
    • https://falesejus.weebly.com/uploads/1/3/1/4/131483218/ziwoworok-ketujiz-wafonaj.pdfIn PDF document text
    • https://rufufuwoka.weebly.com/uploads/1/3/1/4/131454634/4267392.pdfIn PDF document text
    • https://salexutoxor.weebly.com/uploads/1/3/4/7/134761189/2737676.pdfIn PDF document text
    • http://gabixumupa.22web.org/bagijasegifubo.pdfIn PDF document text
    • https://jovivikara.weebly.com/uploads/1/3/0/7/130740330/2020309.pdfIn PDF document text
    • https://rakulemiz.weebly.com/uploads/1/3/2/6/132682689/jopogin.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://94db4134-5784-44c5-a63d-963e509970fa.filesusr.com/ugd/9c58c5_2e0364ceddd0429db02604a131d2c619.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/481ec2f6-b1d0-400d-a797-4aa07ecac4b3/46338813196.pdfIn PDF document text
    • https://6e8b94c7-278c-4a65-9c30-8d61c93a8f31.filesusr.com/ugd/9ff9b8_5e4fa4be8f624636bb4614e96c6207b6.pdf?index=trueIn PDF document text
    • https://275320ff-96dd-455a-9699-a0fdc58b27a5.filesusr.com/ugd/943725_4c06b53039eb4388b5536f4d0e9c9979.pdf?index=trueIn PDF document text
    • http://rixuzomobe.epizy.com/berlin_sans_fb_demi_regular_free.pdfIn PDF document text
    • https://151dec52-cf20-477b-a401-a68195eead79.filesusr.com/ugd/8538f4_428d841e44b6400d9364904f24c850fe.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/41b25233-e552-49b3-a25c-1169f81a5c6e/wivirufepebusuzula.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fb3b4ee-63f8-4ce3-bd10-59761e9cab63/pathfinder_wrath_of_the_righteous_wikipedia.pdfIn PDF document text
    • http://lezujepadu.rf.gd/kazasabamunez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41828494-d0f8-40f8-8dcc-f9f7a8206f78/garmin_gpsmap_60csx_usb_driver_download.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012edd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EDD 4920 bytes
SHA-256: bf6bfc412cc2bebaf8c5a5bcb461c236697bcbf2ca43cb775a5c23dde839da8f
font_01_sfnt_off0001400f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1400F 5400 bytes
SHA-256: 16814c8046791baadc7beb6c41c7c9ca90dc28c697a2a43021f312eb6264442c
font_02_sfnt_off0001525d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1525D 15292 bytes
SHA-256: b93deeaa2b208cf71f338bdeafdf24ad1f68d49228e687d0f52bd2385ee8e38c
font_03_sfnt_off00018528.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18528 16908 bytes
SHA-256: a30dd7f11d4c262f689ebb69d04f2cf4c7493759a3f4d6117de9ab149b59dc65

Open this report in the interactive analyzer, or submit your own file for analysis.