Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf2cd9f7d666f6a0…

MALICIOUS

PDF

106.9 KB Created: 2021-03-25 17:00:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2d62716b64a84746dcd1a318047f3343 SHA-1: c434b8a750659c072d3a1df8803299912baf7eb6 SHA-256: cf2cd9f7d666f6a0787a7051a6f78ebc83e6c23acf3928ef66a9564189a48aa3
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/award?keyword=adenomiose+ultrassom+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4477638/normal_601edc19e4ed3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486994/normal_5fc8c74ba677c.pdfIn PDF document text
    • http://mitimewigupito.mypressonline.com/bank_book.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391921/normal_602ff89bc12b8.pdfIn PDF document text
    • http://rivepozepuxar.mywebcommunity.org/fulltone_ocd_v2_settings.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://sarozaxag.epizy.com/colony_comparison_chart_answer_key.pdfIn PDF document text
    • https://2dcb0092-dd22-4cef-90c1-8c398f802bb7.filesusr.com/ugd/ff3115_ba3d9958adf84f638f0da89bdd8b3cf9.pdf?index=trueIn PDF document text
    • http://wujagenak.atwebpages.com/rainer_maria_rilke_book_of_hours_love_poems_to_god.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/835e8065-9ed4-4725-8e80-32cafffc79cc/things_to_read_to_fall_asleep.pdfIn PDF document text
    • http://zotubune.myartsonline.com/the_monkey_king_movie_2019.pdfIn PDF document text
    • http://jurixosemur.epizy.com/yasin_surah_in_tamil.pdfIn PDF document text
    • https://fb9345b8-40be-4608-a8ff-9c5427dba92f.filesusr.com/ugd/98d639_2c63dffa92094827a14635c1ed7f2f31.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8271ecc8-31df-44c0-9214-b7204fb4e8ff/50426187330.pdfIn PDF document text
    • https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_210de48c753f493ba82d8086eaa2f3f1.pdf?index=trueIn PDF document text
    • https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_78f9ad6357ec4ce5a87c24eef68e3fc6.pdf?index=trueIn PDF document text
    • https://80820154-e864-4b0c-832b-212b24169927.filesusr.com/ugd/c12414_8958f81655d54c3abdc3d961bb179774.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fe66b41-7276-4d04-bb3c-c244e7ffc6ad/freak_the_mighty_full_book_summary.pdfIn PDF document text
    • https://46c0acaa-de7d-4f46-84f0-c2cf1d8ff7d9.filesusr.com/ugd/ac1638_aabf903920bf4b53a5c80e02834f9bce.pdf?index=trueIn PDF document text
    • http://pigepitusedotet.rf.gd/whats_the_pic_answers_clever.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000152f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x152F9 5056 bytes
SHA-256: fde6523d466a7b2c9a2a10378d0bb18b890fd99af162ff6c4ba0dd5339d52eb3
font_01_sfnt_off00016406.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16406 14340 bytes
SHA-256: 28d6a75d87e0c025fd5672ff1ca9d3857460b3da6d779ffac85e8e974ef4b1ec
font_02_sfnt_off00018f03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18F03 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.