Malicious PDF — malware analysis report

Static analysis result for SHA-256 c942419cd4b2d75b…

MALICIOUS

PDF

72.2 KB Created: 2021-03-04 15:07:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 59d7aef5aa861a3eddded8c053e3d6c3 SHA-1: ab85e24833ca72a6190192a64ce8bd76e86c4670 SHA-256: c942419cd4b2d75bca90a5db4c2a44fc88c370058e242a371fc413fa1b6ee8a1
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6871

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=spectra+s1+parts+to+sterilize PDF link annotation
    • https://cdn.sqhk.co/tifisizeliz/jhqii9F/cookie_crush_3_download.pdfIn PDF document text
    • https://cdn.sqhk.co/nenuguvan/drTh2jh/my_ghost_girlfriend_anime.pdfIn PDF document text
    • https://cdn.sqhk.co/vemudumuxixu/aig3iaU/rail_rush_zombie_caves.pdfIn PDF document text
    • https://cdn.sqhk.co/xamitarerivu/r8hiwgd/radio_rock_89_online_ao_vivo.pdfIn PDF document text
    • https://cdn.sqhk.co/mogezunir/rdgbghe/vector_robot_for_sale.pdfIn PDF document text
    • https://cdn.sqhk.co/zopimoforaja/tR3javP/daily_steam_benefits.pdfIn PDF document text
    • https://cdn.sqhk.co/revipidamog/jLH5haP/terraforming_mars_turmoil_gameplay.pdfIn PDF document text
    • https://cdn.sqhk.co/jumupebuvi/jc7iaW6/xavademaxedixodi.pdfIn PDF document text
    • https://cdn.sqhk.co/fofateze/ogjhfsy/age_of_history_africa.pdfIn PDF document text
    • http://winoraama.fun/how_to_use_new_home_janome_sewing_machinerypyz.pdfIn PDF document text
    • http://bazis-rostov.com/the_power_of_now_summary_downloadtskv3.pdfIn PDF document text
    • http://ita-bio.fun/dosatdw4wq.pdfIn PDF document text
    • https://cdn.sqhk.co/wobuwozavenu/gijfrij/famirifupaku.pdfIn PDF document text
    • http://cccckkkkkdd.space/348923979451zgiv.pdfIn PDF document text
    • http://rocketdocs.us/voraxujabumozetegisajotj9j4x.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/29c38c63-3f26-4e55-bab0-4eb594ca97b6/kekugemexid.pdfIn PDF document text
    • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_a813f237e5714bb380bd97d9cec4a561.pdf?index=trueIn PDF document text
    • https://87d7ab8d-8c8f-4a07-83a6-35191ec1a158.filesusr.com/ugd/f4de5e_6a7d9121c9e54384a8e22874f18d54d4.pdf?index=trueIn PDF document text
    • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_131aaba086964b83b947dfd29a714845.pdf?index=trueIn PDF document text
    • https://6cda4dd4-8aac-43e7-8003-7c0eea9f7907.filesusr.com/ugd/34e26e_118739dd594a4b75ae02f8e0fdd2d624.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c138a9eb-5fe5-4eb9-9cdd-ef34911a6926/is_the_ruger_sr9c_discontinued.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1eabd434-fd4c-4b96-ab5a-68e086564427/gejepuniredunotonif.pdfIn PDF document text
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_2d60b1082c0b46b5906f3760806198e8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e06515b-5628-4b61-875b-1eef18f76d46/84369145253.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f19d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF19D 5132 bytes
SHA-256: 4dba9b658a693a7e8307fd42aea965014db6af2bd6afefe607f99e6d999c49fb

Open this report in the interactive analyzer, or submit your own file for analysis.