Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb266a26fcdf75dd…

MALICIOUS

PDF

84.0 KB Created: 2021-04-03 17:10:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 37ce70222a3969349c93cb1a8ef089eb SHA-1: ce8b85d1d3b5e528ccfad753bddf612b6e363ec7 SHA-256: bb266a26fcdf75dded8425134bb8e855cab1717befd072c0ba7d7eec369e7efd
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=ea+sports+ufc+3+deluxe+edition+review PDF link annotation
    • http://zolepop.mypressonline.com/vunuxebiwele.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388272/normal_6021e8d0bdc68.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367310/normal_600c16629ca89.pdfIn PDF document text
    • http://xikisavi.scienceontheweb.net/40234729118.pdfIn PDF document text
    • http://fidesuwuranotif.getenjoyment.net/86293292846.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488807/normal_601fb6f206486.pdfIn PDF document text
    • http://bobujopolodusol.mygamesonline.org/krups_oblo_coffee_machine_instructions.pdfIn PDF document text
    • http://nafepuzemobir.sportsontheweb.net/53775128105.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403428/normal_60372bf46c4f0.pdfIn PDF document text
    • http://kigetipopizatij.getenjoyment.net/socrates_philosophy_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://jowawaba.atwebpages.com/le_banquier_tome_2.pdfIn PDF document text
    • http://tikomiwewo.atwebpages.com/amazon_aws_documentation.pdfIn PDF document text
    • http://najexenij.onlinewebshop.net/pdf_to_word_document_converter_for_windows.pdfIn PDF document text
    • http://daximogosamov.myartsonline.com/wupenigutuvujilapojaru.pdfIn PDF document text
    • https://f79c4d19-9b07-4ca9-ba82-4f938217db57.filesusr.com/ugd/c0d3e8_10f733101d0f4017aff60bed3fdc0c29.pdf?index=trueIn PDF document text
    • https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_601e98991c7242cf8b0a143c77d31b1b.pdf?index=trueIn PDF document text
    • https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_26b56acf24a143c0af9ce265f14c3131.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dddd57f0-3950-43e4-ab37-a35adb67022a/45643029869.pdfIn PDF document text
    • https://8316a071-1c81-4729-bbc9-bb84f51c1359.filesusr.com/ugd/b2ba6b_582a9238da784f71a6899cd74293d9c6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/2747b19a-64bd-4a5d-9b83-597fa76e1e4f/2005_ford_f350_owners_manual.pdfIn PDF document text
    • https://1eb42bdc-3da6-4b32-b75f-4382f1721f8e.filesusr.com/ugd/35474d_1eaa7729adbb4e08b4b693b461f0a18f.pdf?index=trueIn PDF document text
    • http://bujekotu.atwebpages.com/7808168934.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB5E 5372 bytes
SHA-256: c64357481060f5a61483f9c49e974a8d1424dc8dff12ede8fe02f5a6a2def3cf
font_01_sfnt_off00010dc1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DC1 11348 bytes
SHA-256: 4d5d7b9530862009f9fd7338940682b4d037f83b7351657d51cd7707d1648bc9
font_02_sfnt_off00013466.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13466 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.