Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcdd057f81034872…

MALICIOUS

PDF

76.3 KB Created: 2021-03-11 00:05:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 0f8385b763fc5b775ef7b58361d8342b SHA-1: c679df88f54ab34c7a1d54d40b07ad7f05a5ee96 SHA-256: bcdd057f81034872f99d9902452f22e53e66e40637f3c1d41a486070d14f94ff
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8168

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=ampulex+compressa+pdf PDF link annotation
    • http://xuzobinemipivor.mygamesonline.org/the_haunting_of_hill_house_novel.pdfIn PDF document text
    • http://prizinsta24.site/docker_command_install_windowsm06ul.pdfIn PDF document text
    • http://gapagal.mywebcommunity.org/mastering_regular_expressions_python.pdfIn PDF document text
    • http://eferevole.com/gejivurulovilobikesuxax5w4f.pdfIn PDF document text
    • http://xowefew.22web.org/is_there_a_limit_on_houses_in_monopoly.pdfIn PDF document text
    • http://lupuneruw.iblogger.org/compound_sentence_lesson_1c_answers.pdfIn PDF document text
    • http://dosaxixapaxa.medianewsonline.com/how_to_make_kookaburra_bat_stickers_at_home.pdfIn PDF document text
    • http://allostar.buzz/north_face_women_s_jacket_size_guideengs5.pdfIn PDF document text
    • http://kakorixow.mygamesonline.org/94042811449.pdfIn PDF document text
    • http://natnat.fun/spoken_english_classes_for_adults_in_wattalauu3ot.pdfIn PDF document text
    • http://murezisafedamaw.22web.org/mogugunogiravuxubuxez.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/64f65217-6629-4924-8654-8d41380fa784/39984696115.pdfIn PDF document text
    • https://f26e6bca-ce10-4524-9610-ed5ef7c8d48b.filesusr.com/ugd/ac8c68_8098de9d84e84a8b80acdc796be1491b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/40ee3452-4b40-4b0a-b2c4-2af6d4d91f20/sony_smartwatch_3_user_manual.pdfIn PDF document text
    • http://nabenejajoko.myartsonline.com/3411851001.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/262d253f-eed0-445a-8fa2-31f4711abc8c/pifewas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66671113-fe5a-4e61-8ab4-a7b09fb662b6/85463529502.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3d06d77-877f-4022-b62f-dcfc18dd81e1/78732745819.pdfIn PDF document text
    • http://lumigetutiburu.epizy.com/10573025589.pdfIn PDF document text
    • http://pibodowisolizi.epizy.com/jatepanatonubederogu.pdfIn PDF document text
    • https://1d942ef5-affb-47d8-8f99-70a3d187b733.filesusr.com/ugd/3283b0_20196ace1b9b4ec5a0ce64fc08cf32d7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/22975234-af51-4682-bf7c-d9e83059f627/93940815473.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7dbf324a-c754-481d-917c-c4ca572b6c75/36179007066.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e654.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE654 5008 bytes
SHA-256: 9b2c67fdc7e795ed8efdafe085d192a910ff0e819b5d22a1aa8c60ab37e710b7
font_01_sfnt_off0000f75a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF75A 13748 bytes
SHA-256: b44f2e2627b2a310b8cbc995d080582fbedb5f6aaebb56c309b42b82318d3e4b
font_02_sfnt_off000122a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122A8 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.