Malicious PDF — malware analysis report

Static analysis result for SHA-256 b938282492e26754…

MALICIOUS

PDF

66.1 KB Created: 2021-03-07 11:40:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: a328967403da733049123b473a4ec5ce SHA-1: 7b2ac67c804347b6795c4ba64218d613290d0434 SHA-256: b938282492e26754afa26131e0047de913d6c32aeb746d67b1700936aabf7ba4
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=jumper%2527s+knee+after+acl+surgery PDF link annotation
    • https://vemusosafuz.weebly.com/uploads/1/3/1/3/131398108/fotipafifekev.pdfIn PDF document text
    • https://jabevemejo.weebly.com/uploads/1/3/1/4/131483275/6423920.pdfIn PDF document text
    • https://sivajusirev.weebly.com/uploads/1/3/0/8/130814673/4250854.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/woberiz/10181644440.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b3c843c-cecc-497f-b6c1-1956657f6886/what_is_literature_good_for.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b06fb54b-f31c-4c32-ba15-a4b1d737173f/68471239322.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bb8474c-f158-47b3-968a-1775fb2dca72/53240784398.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c4ce676-b6ff-4e51-bcc4-dedf89b313ca/top_secret_recipes_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24ed1fea-14b5-4d9a-8f7f-7fbe8ffc4459/10512190931.pdfIn PDF document text
    • https://1cd0d4d5-11d4-440c-a307-81f73801f601.filesusr.com/ugd/f0e51d_b048aa30bdf3465aafefd6309a856529.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3c5a4c4-df5c-4c33-bb20-3c7d6039302e/mumizam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66a67456-55e8-44a1-9d81-df88b136d46f/mafaxudiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b553fc5-35d5-43ea-bf98-1fb44a0cf8f3/semudetasizoxobudapuvili.pdfIn PDF document text
    • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_2ee22993ac1944eda8de4ed4c0f2c342.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/siguteluk.pdfIn PDF document text
    • http://jegujijixunef.rf.gd/what_does_deviance_mean_in_sociology.pdfIn PDF document text
    • http://vulevusevugola.epizy.com/charla_de_seguridad_sobre_covid_19.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2a36610-3337-4ec5-bbf2-24e10efc2bf9/nezatabotob.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eebc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEBC 5248 bytes
SHA-256: 1c1b872d0cbf07f6c439ef0b2c064a846089d33ffd6490f41d956c9b5d3c41b7

Open this report in the interactive analyzer, or submit your own file for analysis.