Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce9b3ca2591c2918…

MALICIOUS

PDF

89.3 KB Created: 2021-05-27 23:45:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: d4cc89f6afa2fdbe573d71e4687066cf SHA-1: 15244abe3bb61d92c6c81a5391c70e7414f981be SHA-256: ce9b3ca2591c2918d955711eca758cabc90e2271270dc3ef50ecac0948c453b9
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains a significant number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to malicious content. The document body, though heavily obfuscated, contains metadata related to "captive portal pfsense html template" and authoring tools, likely serving as a lure to encourage clicks on the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=captive+portal+pfsense+html+template PDF link annotation
    • https://tewonubipudi.weebly.com/uploads/1/3/6/0/136016370/8953859.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407316/normal_601e20dff0ab0.pdfIn PDF document text
    • https://panujiwawavila.weebly.com/uploads/1/3/4/4/134457592/xuzaxigo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455898/normal_5fcfa13e8c4a6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366952/normal_600b76444d99f.pdfIn PDF document text
    • https://favigexa.weebly.com/uploads/1/3/0/7/130738696/ferodawogagivuretel.pdfIn PDF document text
    • https://lotekine.weebly.com/uploads/1/3/1/3/131381428/611fb2.pdfIn PDF document text
    • https://jefiwosu.weebly.com/uploads/1/3/1/3/131379536/4b4ad94d83a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391921/normal_604b791f51ec0.pdfIn PDF document text
    • https://popoxalisasuper.weebly.com/uploads/1/3/0/7/130775362/43fb2b61.pdfIn PDF document text
    • https://dituwugo.weebly.com/uploads/1/3/4/2/134235792/lofijuxemivite_togilofa_malukuniwagona_duwoleka.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380395/normal_5ff182ac987da.pdfIn PDF document text
    • https://delazodudiz.weebly.com/uploads/1/3/4/5/134591817/jizazojatetizef_zovijepenotu_tidif_nigetobovejafu.pdfIn PDF document text
    • https://letotanuvimipe.weebly.com/uploads/1/3/4/5/134598603/zupezejuzagiser-monebidinu-duvosuziba.pdfIn PDF document text
    • https://gojefofowuf.weebly.com/uploads/1/3/4/5/134596001/xuwefenubujopam_riligizupun.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d52cbd4e-4114-41e6-b878-ebe522e7fb95/nvivo_student_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8dfcaae8-d4b4-4c50-bc5d-241af64016a7/como_realizar_una_hipotesis_en_un_proyecto_de_investigacion_ejemplos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7d20f4e-c62d-448b-8dee-76c03549504c/cultural_anthropology_asking_questions_about_humanity.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac64f69e-7d02-418c-81f5-189fa0d6923c/what_is_the_second_book_of_touching_spirit_bear.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e89e1064-85e3-49d5-b204-f53eac2358e1/88984751396.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f6fe7d4-d09d-4c6b-be55-7086e5dd5f66/92089077841.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/009ec898-b57e-4d54-985f-4eefde5497f6/john_grisham_books_goodreads.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6B6 6424 bytes
SHA-256: e637e929042e3978bec96b31b3490ba660419ed310d31d627162007a830036f1
font_01_sfnt_off0000f697.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF697 5108 bytes
SHA-256: a469146736e1561caabc76092c6ff506d98676d05de7845b45456c81e190cf90
font_02_sfnt_off000107ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107CA 5700 bytes
SHA-256: 5ccbd0c830622bc3c3d17738933068a035e77409711a379fa5c81ab30ce78760
font_03_sfnt_off00011b55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B55 10884 bytes
SHA-256: 1dc0ab86641720834e8bd8851daf48d8937bef75812a8535d5d2ceed19b55d06
font_04_sfnt_off000140d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140D1 16128 bytes
SHA-256: 87858e0160fdc663af7362e2c123a932a30bf342626b15f8f4c0a2a4d0f5d7ce

Open this report in the interactive analyzer, or submit your own file for analysis.