Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6317b68e6b35069…

MALICIOUS

PDF

80.0 KB Created: 2021-04-22 08:52:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 11068b58e42d7a2f4617d821622d210b SHA-1: 24be4f19b842660784fa45128a97ec1d537348ae SHA-256: c6317b68e6b35069f9a1821af19ce9526ec2c8fc96e2de9066cdba1512c1fd49
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with one specifically pointing to a suspected phishing site. The PDF's structure and embedded content suggest it is used as a lure to direct users to external malicious websites, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=because+i+could+not+stop+for+death+theme+sparknotes PDF link annotation
    • http://hookup157.site/arnie_the_doughnut_worksheetswo2mf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485946/normal_6067ca0ac721e.pdfIn PDF document text
    • http://xozonline.ru/tanofatuvozevaxoteaiuk.pdfIn PDF document text
    • http://yildirimotobursa.com/50290674107e3pp9.pdfIn PDF document text
    • http://junumidutuzakox.getenjoyment.net/abraxane_pi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446636/normal_605bf25826c64.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4503214/normal_60219dcc6a816.pdfIn PDF document text
    • http://alfa-quest.ru/best_man_down_full_movie_online0gk4i.pdfIn PDF document text
    • https://cdn.sqhk.co/tomubozes/Q2RZIij/18159369505.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447273/normal_6009f86f74e54.pdfIn PDF document text
    • https://cdn.sqhk.co/nufesewepi/2lBihKa/shipwreck_restaurant_brielle_new_jersey.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412174/normal_60409d7d9d4c2.pdfIn PDF document text
    • http://b0xberry.online/duden_die_grammatikgihn6.pdfIn PDF document text
    • http://lolkek.xyz/construction_bidding_processcagfx.pdfIn PDF document text
    • http://saxobupazes.sportsontheweb.net/26228953700.pdfIn PDF document text
    • http://fb-ig-violation.com/pujajelosuzelel1sib.pdfIn PDF document text
    • https://cdn.sqhk.co/xugavizira/hhiibjh/pixibosugirufojiwibun.pdfIn PDF document text
    • http://sewatumafuta.medianewsonline.com/76271720109.pdfIn PDF document text
    • https://cdn.sqhk.co/wubunepan/gflPjhh/fexepifo.pdfIn PDF document text
    • http://gravkamen.ru/los_vimanasfzfvd.pdfIn PDF document text
    • http://storergoods.site/dezatibijaboxewiwofensasjf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cb47f074-0476-4434-b381-5672a365cab8.filesusr.com/ugd/c46c8a_0b3cdedd60964dbc979b7843e197a81f.pdf?index=trueIn PDF document text
    • http://gapoxuvopa.onlinewebshop.net/cephalalgia_headache.pdfIn PDF document text
    • https://167c2301-eccc-4e3a-a609-38a4f17b9bf8.filesusr.com/ugd/b1dabf_98d6c52b7afe4b67ad1746ee261e37b0.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA42 5508 bytes
SHA-256: 5c6cc8981a3d4850f83167335837dd90bcb30b419a8fdf0e0914936ad4a603df
font_01_sfnt_off00010cd1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CD1 10832 bytes
SHA-256: a4fc560298f6e2598e9ce9212644b8b51a0605a7000be26a0eb4dced63108201

Open this report in the interactive analyzer, or submit your own file for analysis.