Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8080e0b290d8d57…

MALICIOUS

PDF

72.4 KB Created: 2020-11-19 00:28:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: a1332878a071b1632ad33c75122e7aa8 SHA-1: b80ef05bf865bde416cb3d3046901107cdec3fe2 SHA-256: c8080e0b290d8d57f61c2bd2bf0609defaa8488708bea8f9297bbe4a5e1ae1f8
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=cub+foods+jobs+eagan+mn PDF link annotation
    • https://tazejoga.weebly.com/uploads/1/3/1/3/131383942/9662927.pdfIn PDF document text
    • https://zepixufiguw.weebly.com/uploads/1/3/4/1/134108583/6895318.pdfIn PDF document text
    • https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/xosorux.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/946b4dc3-699a-4c23-9c7c-5c213c7d8d47/bikagaxedolene.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/rarowofu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37587ad6-2664-4553-b5ce-c81133c6b70f/introduccion_al_urbanismo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8142938c-a7d8-4616-892c-3121324722f5/xabalerukemenolu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/780c0b15-79e1-49db-bae6-efe005dc237e/determining_relative_age_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0fcf31e-c435-4a78-9810-2feff97ec5ed/pythagorean_spiral_draw.pdfIn PDF document text
    • https://s3.amazonaws.com/dojivewobasuval/83007440211.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44eb0971-a671-4fc0-8008-061941f4ccec/lepuxudusonukovomosexu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f3f7dbb-e1e7-46b3-82df-448bb4f9c6cb/free_medical_billing_and_coding_stud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9aaed5b8-5145-40b3-9d14-67fcb80855f0/historia_de_espaa_2o_bachillerato_esquemas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9efe3e4-eb39-4adb-b657-a981fb5c1c34/mokipoginilukuzez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5e2525a-1f6f-4c7f-b6d2-4c7cae53caff/varukonumajodawakewe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD26 5220 bytes
SHA-256: 7bc66e7e2c5221d32021f8073eb78c79425f77c6f5cd59127290ed6639f6d124
font_01_sfnt_off0000eedf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEDF 11252 bytes
SHA-256: b923f6b5f4681440b770837b5a8829b80c14eec8c02ee8c5921bd75d08ddea48

Open this report in the interactive analyzer, or submit your own file for analysis.