Malicious PDF — malware analysis report

Static analysis result for SHA-256 ced913ba28f9c9d7…

MALICIOUS

PDF

108.3 KB Created: 2021-06-09 11:15:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 501b7ae007017534055f52e59b579f38 SHA-1: 45885fb74d7bb0acbe1aef79f8894ab20d969503 SHA-256: ced913ba28f9c9d7c6a83136e737e9ce63d6904dd9d3c6a8fb7781b44b04a8d1
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=attack+on+titan+season+2+episode+5+eng+dub PDF link annotation
    • https://jonasajikisewo.weebly.com/uploads/1/3/4/8/134855139/megodolobeviw-dusosisatu-vigevej.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489852/normal_5fd8d961d5baa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387826/normal_605f444b54202.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373788/normal_6022bf7dd2810.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412767/normal_60b92e8cb0285.pdfIn PDF document text
    • https://gulapizebulo.weebly.com/uploads/1/3/1/0/131070336/rudopofisut.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417426/normal_5fd1c91f0f615.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501037/normal_60391c868ab94.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420244/normal_5fdffde783028.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401696/normal_6020632dec2b9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488317/normal_5fcdf9cfd5ce2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b4276c58-334a-4c65-a880-c1230ff7c28c/am_walking_away_quotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d440ac46-914f-4cdf-ae38-73d697c9b451/92739603656.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e23f6162-fe33-450e-a468-f00d2e9868cf/sp_netadvantage_industry_surveys.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/089687dc-99c1-4db9-8744-cf795f7db6b5/turalamotaxurujer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df5f9bdc-09b7-49b9-85cd-c9337a1824d1/how_to_play_imessage_games_with_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab3b40af-75c0-4997-9958-e3c79f1db2e4/free_printable_california_rental_agreement.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c174b079-bc20-427f-b0b6-ffff22f149bc/nutamadilurulo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3de1ccd4-ef60-4166-a21f-e48b491d7c44/webolunulotagiwezo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a3352e2-c8d4-40e5-8065-27abcd3d9713/the_5_love_languages_test.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e01b6d7-a9bc-458b-987a-b22d804646d2/spice_and_wolf_episode_13_what_did_holo_do.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB39 35520 bytes
SHA-256: 4230b850f80caed302c02aa3bfc14b93e917fd4d8e600906c7afb5ab5fc34fff
font_01_sfnt_off00015a2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15A2F 5444 bytes
SHA-256: c7ddbce0a000c0d92f79c4c00a04c93e1450c70a2bba28db531db63382b3ebcb
font_02_sfnt_off00016cc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16CC2 12296 bytes
SHA-256: cb8dff85c3cfd8820a0d478fe3747f9978b85d946b8dc82749954dc04d4f1e78
font_03_sfnt_off00019523.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19523 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.