Malicious PDF — malware analysis report

Static analysis result for SHA-256 b969f4bb3b753fbd…

MALICIOUS

PDF

80.0 KB Created: 2021-03-31 21:53:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: c8ae5d6c0987c42a8637a17016faf0ac SHA-1: 5fa331561efb331464ed016b91bc27cfee7656c1 SHA-256: b969f4bb3b753fbd776b9602101c464607845eff9bfcba4970989b8adc7d3c0e
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6520

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=aladdin+film+music PDF link annotation
    • http://delabozaxexiris.getenjoyment.net/download_base64_javascript.pdfIn PDF document text
    • https://cdn.sqhk.co/gujowaxexag/vXShhej/strategy_meaning_in_tamil_language.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470553/normal_6022916eba9dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469103/normal_60121708a6650.pdfIn PDF document text
    • https://cdn.sqhk.co/fodexuxefeba/ehhXbo3/teriduzetofe.pdfIn PDF document text
    • http://fuxezaboxekave.scienceontheweb.net/psychology_books_in_urdu.pdfIn PDF document text
    • http://vitetoka.scienceontheweb.net/52754058267.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373522/normal_60510bd905d09.pdfIn PDF document text
    • https://cdn.sqhk.co/zejizoguzut/haVwgha/19169556439.pdfIn PDF document text
    • http://migasoloraluxuj.scienceontheweb.net/bsc_1st_year_maths_notes_rajasthan_university.pdfIn PDF document text
    • https://cdn.sqhk.co/jurugaguvedu/jjS62Pg/25528418353.pdfIn PDF document text
    • https://cdn.sqhk.co/mikedeto/eidhijf/98479910084.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4375077/normal_5feb64f31fe9e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378827/normal_604f20a00809e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465543/normal_6012dc7956d0a.pdfIn PDF document text
    • http://pexarinolal.mypressonline.com/how_to_change_date_and_time_on_timex_marathon_watch.pdfIn PDF document text
    • https://cdn.sqhk.co/dogutadova/C0pgghh/91749734041.pdfIn PDF document text
    • http://dipenoguzel.sportsontheweb.net/kenmore_elite_795_refrigerator_water_filter.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461204/normal_5fe55547c14ed.pdfIn PDF document text
    • https://cdn.sqhk.co/puzusagilem/hyskhiN/binder_android_developer.pdfIn PDF document text
    • http://momarivido.mypressonline.com/ryuk_death_note_movie_actor.pdfIn PDF document text
    • http://wosozage.mypressonline.com/bacteriological_analysis_of_drinking_water.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426066/normal_604de1edc6df2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rijonitapadon.myartsonline.com/cisco_4742hdc_manual.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000118cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118CD 5060 bytes
SHA-256: e4229db9c3706da055d2169645a34b003332a25eae18fcb04db7f92e953ec299

Open this report in the interactive analyzer, or submit your own file for analysis.