Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd60eb50a1027c4c…

MALICIOUS

PDF

80.8 KB Created: 2021-03-24 04:19:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b866dadd65fb15f943e32199607bc86 SHA-1: 79d98f38b6b217d2a00fa443167c66273321de6b SHA-256: cd60eb50a1027c4c290cb4980455ae2ef1be99406f36b912edbe81b28a00d065
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, indicative of a link farm designed to improve search engine rankings for specific keywords like 'canon lide 110 scanner pdf driver free download'. This technique, combined with the 'SE_DOWNLOAD_BUTTON' heuristic and a high ML classifier score, suggests a phishing or malware distribution attempt. The ClamAV detection further confirms its malicious nature, likely serving as a lure to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=canon+lide+110+scanner+pdf+driver+free+download
    • https://cdn-cms.f-static.net/uploads/4408587/normal_6032a047cb7aa.pdf
    • https://cdn.sqhk.co/kozutani/eMX9fhb/22653227662.pdf
    • https://static.s123-cdn-static.com/uploads/4365584/normal_5ffa29c89d2ed.pdf
    • https://cdn-cms.f-static.net/uploads/4427820/normal_6033ff5c66ae9.pdf
    • https://cdn.sqhk.co/kofisosiz/IhgzigR/wexugijititasaxifibisa.pdf
    • https://cdn.sqhk.co/mafowixodi/GEiV8jg/fagutapuwelowukibem.pdf
    • https://cdn-cms.f-static.net/uploads/4413982/normal_60246ef02a14b.pdf
    • https://static.s123-cdn-static.com/uploads/4368751/normal_5ff7e67f852ed.pdf
    • https://cdn-cms.f-static.net/uploads/4486190/normal_5fdc1ec701743.pdf
    • https://cdn.sqhk.co/xizefonuma/IM6gegi/at_t_business_account_number.pdf
    • https://cdn.sqhk.co/fuluzagile/c136G7Y/war_card_game_rules_casino.pdf
    • https://cdn.sqhk.co/rajemaramiw/dighgjb/63684393112.pdf
    • https://cdn-cms.f-static.net/uploads/4494648/normal_603f55ebec5ce.pdf
    • https://static.s123-cdn-static.com/uploads/4497356/normal_6004320bb630d.pdf
    • https://cdn-cms.f-static.net/uploads/4375341/normal_6056767a321e1.pdf
    • https://static.s123-cdn-static.com/uploads/4493578/normal_5fc880da8921b.pdf
    • https://cdn-cms.f-static.net/uploads/4488574/normal_6012432e6f452.pdf
    • https://cdn-cms.f-static.net/uploads/4417426/normal_6049beb559c05.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e49cd12a-7e53-4a25-9f98-ae37b5ff2e44.filesusr.com/ugd/35dc59_181a64112cba4241988b2ea7362ffc2b.pdf?index=true
    • https://30fe55a9-f0c7-4aec-9bf5-b9d2225d99a8.filesusr.com/ugd/c4a51e_ffbce2b16a65499bae104ff53ac009e1.pdf?index=true
    • https://356bbf58-84af-4bff-99a9-d03346e46411.filesusr.com/ugd/b5472a_e364f7da480a437d8dc9e412156d7318.pdf?index=true
    • https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_e5bd62b181c74d4eb2199639fdc4149f.pdf?index=true
    • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_0c2f06ae134045299e64d4c077806cf8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbd5.bin
8313437de9c2f07d68d755f8b86e179aee358c0dbb123963cc3efe22aea74831		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD5 5400 bytes
font_01_sfnt_off00010e57.bin
e8da6224baac33d9feef488eef229a4411ca442e32b3bd3e711f6e4170a03420		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E57 11568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.