Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0058404431e60bb…

MALICIOUS

PDF

93.5 KB Created: 2021-03-18 19:20:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 342041a56ff7cf839e538cc281c43751 SHA-1: 560fc61ed96f2a70f5faf00737bdc96ebe041a72 SHA-256: d0058404431e60bbde808d749df422a160631291597d2a747108bd19890c7e9a
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=corrugated+plastic+sheets+4x8+home+depot PDF link annotation
    • http://vivadoctor.ru/manual_and_automation_testing_interview_questions_for_freshers4vgdn.pdfIn PDF document text
    • http://juzajikadig.22web.org/2019_movies_tamil_full.pdfIn PDF document text
    • http://modernstyle.pro/fgdp_radiography_guidelines_referencejcopp.pdfIn PDF document text
    • http://beststudent.fun/hellbent_face_revealjmf18.pdfIn PDF document text
    • http://ranking-se.com/83596110882foaum.pdfIn PDF document text
    • http://lessonsonline.site/schlage_key_lock_resetmf7wa.pdfIn PDF document text
    • http://muldwych.com/app_music_to_phonekaukn.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://josunida.epizy.com/muscle_contraction_pogil_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/08825746-8923-4dee-9284-cf3fb0e38b30/oracle_pl_sql_developer_fresher_jobs_in_bangalore.pdfIn PDF document text
    • http://vofofoduwegakuv.rf.gd/sezasamazunid.pdfIn PDF document text
    • http://kujinid.rf.gd/temperature_conversion_chemistry_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a62e72d-629d-422d-8eea-60fc6b660efb/my_papas_waltz_analysis_tone.pdfIn PDF document text
    • http://sapakebozo.rf.gd/ubqari_magazine_september_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1311a756-0ca3-47ed-a25d-e3e70463542d/cuisinart_coffee_grinder_setting_for_chemex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6055ac98-e025-4e96-8573-dd1694a974cb/85611788547.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d91b12d-6499-49f8-b74a-cc6f6d903237/motorola_ht750_uhf_portable_radio.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bf0f0a9-808f-4ea8-88c2-3aff2473060d/13226130587.pdfIn PDF document text
    • http://mumuvovowoxoje.epizy.com/where_can_i_drop_off_old_clothes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbf54c9c-07ad-4976-a991-2bd3592efbee/sukefikasus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012968.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12968 5744 bytes
SHA-256: 6c6f6cee67084af8f80f3b09bd1a84aaa45b9c17bfba2c5f7d1901579d45e9e3
font_01_sfnt_off00013cd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CD5 13504 bytes
SHA-256: f9e4a1320509104fd399929dc465bd55e76fcee1b0b7bff8b0153ada8f6c3280

Open this report in the interactive analyzer, or submit your own file for analysis.