Malicious PDF — malware analysis report

Static analysis result for SHA-256 be3e2c3ceb46f343…

MALICIOUS

PDF

129.8 KB Created: 2021-03-16 01:59:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 7d3f4739b2dffa5d3d0532fd264d178c SHA-1: 141f61bb25870662a58d5078b99d906700a7d9c1 SHA-256: be3e2c3ceb46f343021f5dcd2736752cae613c4dc8fa80f798f4765ba59fbf3c
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=honeywell+th8320r1003+operating+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4484363/normal_601a75fa91614.pdfIn PDF document text
    • https://cdn.sqhk.co/mewuwemiromi/Gig6igC/hay_day_pop_iosgods.pdfIn PDF document text
    • https://cdn.sqhk.co/tewisifupib/hh5gimD/raid_shadow_legends_meme_compilation.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423428/normal_5fe994a97b5f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367017/normal_603f53fe8eb91.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403418/normal_600c061423f40.pdfIn PDF document text
    • https://cdn.sqhk.co/febutatesu/dDheVij/radio_en_vivo_mexico_noticias.pdfIn PDF document text
    • http://sinekem.iblogger.org/bienestar_laboral_libros.pdfIn PDF document text
    • https://cdn.sqhk.co/nuvaratuji/gcvPibV/20383427025.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367277/normal_602f422350b37.pdfIn PDF document text
    • https://cdn.sqhk.co/nifodotiriru/H2jbBja/41023417036.pdfIn PDF document text
    • https://cdn.sqhk.co/bijukipuj/cDPidja/color_by_number_addition_worksheets_printable.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418178/normal_604d61a03971a.pdfIn PDF document text
    • https://cdn.sqhk.co/ninulekuto/dkYeYed/xadop.pdfIn PDF document text
    • https://cdn.sqhk.co/ponesigis/2ifrpha/xuvuropexesa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379222/normal_5fe1d77068524.pdfIn PDF document text
    • https://cdn.sqhk.co/pumibavi/iW9haRU/battleship_cove_gift_shop.pdfIn PDF document text
    • https://cdn.sqhk.co/pibutuvopedu/yeYaifY/datekuregivoxe.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9198d82f-67d3-4510-91f4-f8f69b0ce8a7/gekopetutu.pdfIn PDF document text
    • http://tawatibajat.rf.gd/makokesoposofipujemiz.pdfIn PDF document text
    • http://diveruwafulebes.epizy.com/eosinophilic_esophagitis_guidelines_aga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f873b56f-fd01-41fe-9e03-e88cbbb09071/convotherm_combi_oven_parts_manual.pdfIn PDF document text
    • http://fijazijan.rf.gd/kennedy_why_england_slept.pdfIn PDF document text
    • http://pajisusag.epizy.com/ominous_octet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001b740.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B740 5896 bytes
SHA-256: ad739c4c00df45d5cf0992c82457bae42f5daf654b53467c5cbcb1e940919562
font_01_sfnt_off0001cb43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1CB43 14160 bytes
SHA-256: f0a0922835af3c481004645f00c77abad7577adbc6b5a24f30f561a12fe80474

Open this report in the interactive analyzer, or submit your own file for analysis.