Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6cfe5c07803419d…

MALICIOUS

PDF

77.0 KB Created: 2021-03-21 12:36:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 04b416d64763e9d0c67db2b357ed2686 SHA-1: d56c37cd18c372278fff5c2dcbf46a1e60a0ea81 SHA-256: c6cfe5c07803419d05042142ddbb3ea40a877019c26f52d706de341fa20e9d72
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains numerous embedded URLs pointing to disposable domains, suggesting a link farm designed to redirect users to malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically highlights this tactic, and the presence of a download button lure further supports the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=nts+result+answer+key+rescue+1122 PDF link annotation
    • http://axacheat4.xyz/gudakonabotazuve1nzzd.pdfIn PDF document text
    • http://world-wildshop.com/61892095010vs5t9.pdfIn PDF document text
    • http://bitsracing.net/jiludizowamiwusuxoxonp8dpq.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454543/normal_5ffbd273a2b18.pdfIn PDF document text
    • http://cheatyou.site/dimawatutygtoy.pdfIn PDF document text
    • http://copyrightsupport-ig.com/nupovesejunikoepsts.pdfIn PDF document text
    • http://maddot.space/sprint_dial_codes_iphoneeiy09.pdfIn PDF document text
    • http://compte-cmbretagne.best/tabla_de_distribucion_normal_estandarizada_completawu7wa.pdfIn PDF document text
    • http://erkutungotu.com/past_paper_acca_f5v8oi0.pdfIn PDF document text
    • http://plsale.pro/556066483777f6s.pdfIn PDF document text
    • http://help-ruleviolation.com/76983470640qmtc8.pdfIn PDF document text
    • http://uabiomanix.xyz/cardinal_and_ordinal_numbers_english_worksheetbethc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479441/normal_60078fc6e2606.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385633/normal_6053007748888.pdfIn PDF document text
    • http://rorabuvarumezip.22web.org/how_often_to_change_transmission_fluid_honda_accord_2008.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/903b29bf-c6f2-44fa-8fa8-8d5783a70361/what_is_180_degree_viewing_angle.pdfIn PDF document text
    • http://mizebowofaz.epizy.com/char_broil_performance_t36g5_test.pdfIn PDF document text
    • http://rixuzomobe.epizy.com/wuxizox.pdfIn PDF document text
    • http://kexejitevomosef.rf.gd/ronibideraboxomuduzofodo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0048b983-d339-4d4c-8f54-baadb416f8b4/27211360850.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e242.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE242 4928 bytes
SHA-256: 68d198e7c14a967a1022a7c2d21ad6dc972ac2ca7a1017df1ec2db5a149adee1
font_01_sfnt_off0000f330.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF330 10968 bytes
SHA-256: e0d5b9e475d3556d02a99f86840d860c15790ddba3b13fc62e622bf66f41f042
font_02_sfnt_off0001186c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1186C 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.