Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2c3fe9c8d3c57d9…

MALICIOUS

PDF

112.9 KB Created: 2021-05-31 12:51:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 346dfaa3c49c7d2c2257e87438e924ca SHA-1: 596cd691b996f7591648d4db4cbd09f0099a788b SHA-256: c2c3fe9c8d3c57d9869e2d9a7a70d076139b6b8f7b33debff82bf958d3427957
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable hosting, indicating a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9628

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/123?utm_term=arise+simple+past+form PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4379731/normal_606a654f8350e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459941/normal_6037df953b7a0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454809/normal_6008c86dcdedc.pdfIn PDF document text
    • https://kimakinogi.weebly.com/uploads/1/3/0/7/130775446/703153cd5fbf05d.pdfIn PDF document text
    • https://pawasisuleti.weebly.com/uploads/1/3/4/6/134652657/sojivama.pdfIn PDF document text
    • https://tozupefiga.weebly.com/uploads/1/3/4/2/134265365/4016195.pdfIn PDF document text
    • https://tedaliduvif.weebly.com/uploads/1/3/5/9/135957254/wewupupupufokanofima.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383574/normal_605367134cfb0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446930/normal_6011779b7225a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386084/normal_5fc620e02525d.pdfIn PDF document text
    • https://muxupodijem.weebly.com/uploads/1/3/4/8/134885552/135b36.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476566/normal_600a68a31dfab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448718/normal_5fd288b1c04c2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388813/normal_5fc7508fa4088.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4504791/normal_603881f1f090d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449776/normal_5fe61c0b89ef3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd4a9354-d26b-453d-9e1c-cec804d99b1b/how_to_treat_metabolic_acidosis_at_home.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49665dd5-9bf2-4c91-a2c2-9e4bf5ab8165/digital_control_system_analysis_and_design_solution_manual_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66ed67f1-7cc4-414a-86e6-770a8b635dff/chapter_assessment_examen_del_capitulo_1b_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed6310e1-4e25-4361-b9f8-0106bca0adef/motorola_g6_wallet_phone_case.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21be6a42-3e20-4ca9-849c-ed1e096c3077/can_you_lose_weight_on_dash_diet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/649101b4-e4a7-4caa-9c44-2454dfcc9920/62296081503.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81bf5d51-d37f-4436-88e2-40e8b37cd6c4/clash_of_clans_mod_apk_coc_magic.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001010e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1010E 5944 bytes
SHA-256: 2ab810cb60004d06341b1d44e3d1db9eb471f852be13b2b9ca731739fcb1a61f
font_01_sfnt_off000115a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115A9 4720 bytes
SHA-256: 3ce4b62aa9bf1a0446c25df08862ea1a33fb8bde73f4e6119e0d6c722344c69c
font_02_sfnt_off0001259b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1259B 4180 bytes
SHA-256: df22aea44ccb73fea8ee014cfb3b8b46d26fd138265a48c4d7f9e1dcd42099eb
font_03_sfnt_off000132e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x132E6 1924 bytes
SHA-256: 2ed00d5787f1f1ec079091f18b2c41a1e1cbf0360a4b8fa0bc985ef7417b77a1
font_04_sfnt_off00013c05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C05 8188 bytes
SHA-256: 04f00bfc4217ba18c4cf982052d9ef2c118e774c9c7d9a986531e8695392b2ad
font_05_sfnt_off000152a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x152A0 16768 bytes
SHA-256: 57ed04d37a9cb1e90cada358f24f68a27527368869570ec6d1a5e91b45f16457
font_06_sfnt_off000183a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x183A8 16524 bytes
SHA-256: e40ca9063cb674f731a1912696616c9e7f55336eaffa443480b1ebc8881c7403
font_07_sfnt_off00019a11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A11 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34
font_08_sfnt_off0001a816.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A816 2636 bytes
SHA-256: ee8bba94ca24956a228ae79bb88d2c12563174addb972f810469a070b907ed9c

Open this report in the interactive analyzer, or submit your own file for analysis.