Malicious PDF — malware analysis report

Static analysis result for SHA-256 c94136dc69b9ab07…

MALICIOUS

PDF

69.0 KB Created: 2021-04-06 14:28:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 73cee26a867c8ed325f084d7c6990a6c SHA-1: c5986cf92c7de536d99a8b9816593f48b35a675a SHA-256: c94136dc69b9ab07c912ec996af505f6c3060caa026d6eb58c7b1ed165499d60
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=historietas+capulinita+pdf PDF link annotation
    • http://meine-gebuhrenfrei.com/29718826356c56tb.pdfIn PDF document text
    • https://zavowajasobi.weebly.com/uploads/1/3/1/4/131406950/2d8dfc3c8cf9e8.pdfIn PDF document text
    • https://viwalamul.weebly.com/uploads/1/3/3/9/133997630/gibafoguvalaketumo.pdfIn PDF document text
    • http://wejaduz.mypressonline.com/definitions_of_history_by_different_authors.pdfIn PDF document text
    • http://cmb-societe.com/bufabavulabirimod0elt.pdfIn PDF document text
    • https://cdn.sqhk.co/zowonefaso/Ghe7gfn/38620055690.pdfIn PDF document text
    • https://visegonikagade.weebly.com/uploads/1/3/4/6/134626066/sutofosuminomup_mevaxebu_dejafemefex_xirujenifuwuriw.pdfIn PDF document text
    • https://cdn.sqhk.co/xufojidaju/iiZha9W/58194402417.pdfIn PDF document text
    • https://cdn.sqhk.co/rinugezig/Xjjiiic/the_elevator_shaft_escape_room_review.pdfIn PDF document text
    • http://kewotij.mypressonline.com/dotaxegixazatuz.pdfIn PDF document text
    • https://cdn.sqhk.co/kogoruzojif/jo3t8rD/microsoft_sharepoint_foundation-_compatible_application_edge.pdfIn PDF document text
    • https://ladeletoleworuw.weebly.com/uploads/1/3/4/7/134712388/ziwujasejerulamozigo.pdfIn PDF document text
    • https://cdn.sqhk.co/vozevadijut/aRhjhig/red_lobster_endless_shrimp_2020_canada.pdfIn PDF document text
    • http://gepopusoka.mypressonline.com/nutricion_y_alimentacion_de_animales_d._c._church.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6739ca04-605d-4ff4-b4c9-4e5bd75a7819.filesusr.com/ugd/031dda_098ed84ce542498390b9a4fd3a30b20e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/65c88c0d-61e7-47f3-ba9a-8d9ec3a94a6e/vobukagamok.pdfIn PDF document text
    • https://32b33340-d9da-4ef7-b3bd-a0ac5134eb71.filesusr.com/ugd/adfa6f_d6109793c53b445bae7f1ab1951f7ece.pdf?index=trueIn PDF document text
    • https://7d7e9a41-1eea-4c72-a0b8-c0e3d642de37.filesusr.com/ugd/513cfa_26639b141964478a8f3f526be25efb6e.pdf?index=trueIn PDF document text
    • https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_feaaf7ce7aad477497c32dc65a792b99.pdf?index=trueIn PDF document text
    • http://sujunutab.atwebpages.com/zomukoputasudiwitigefiro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/160af108-9e38-4faa-a1ab-2dd7855a4e8b/69093252757.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cec2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCEC2 5112 bytes
SHA-256: df2188aadab193226544938a9bd93d8ed0c2b017f395d6cdf5788081fec8cfa6
font_01_sfnt_off0000e030.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE030 11204 bytes
SHA-256: 71356ef5cebe249c12eb59319e947b8440ba1b8ecd830e2759a5b3188510e730

Open this report in the interactive analyzer, or submit your own file for analysis.