Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0dc7ed4288015e4…

MALICIOUS

PDF

99.6 KB Created: 2021-03-04 17:44:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 030535ad7a206a01ab8fb4a95d340c7e SHA-1: 30a15990682a00f4f6d13fa2486741a86948b938 SHA-256: d0dc7ed4288015e4306b9161da9a42ba37080320f64616c34a5a922c48567286
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6193

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=what+does+the+rising+sun+mean PDF link annotation
    • http://raisinshub.pro/sda_church_close_to_me42snf.pdfIn PDF document text
    • https://cdn.sqhk.co/rabataxuvax/injeibl/724_stg_eod.pdfIn PDF document text
    • http://websporizle3.com/pixeporuzevqmbg.pdfIn PDF document text
    • https://cdn.sqhk.co/letopoto/FIsMNih/jowubi.pdfIn PDF document text
    • https://cdn.sqhk.co/wifopuzuxiba/vfBhgge/gutschein_media_markt_online_bestellen.pdfIn PDF document text
    • http://finonit.mypressonline.com/50743357163.pdfIn PDF document text
    • http://strahuemsya.info/6337768041px6dd.pdfIn PDF document text
    • https://cdn.sqhk.co/tolononof/qhcjhTk/vezaxuso.pdfIn PDF document text
    • http://ligalirulal.22web.org/58449284187.pdfIn PDF document text
    • http://ontrade.top/40582826066o2p2x.pdfIn PDF document text
    • http://optamorem.com/mitupediwogonabefatocp111.pdfIn PDF document text
    • http://kirakexig.mypressonline.com/diary_of_a_wimpy_kid_rodrick_rules_book_summary.pdfIn PDF document text
    • https://cdn.sqhk.co/zikufivol/fCifjkx/litupudutijiwerewetijo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://9e1b5e4e-b4ab-405b-8fdf-b3b6d7b19c28.filesusr.com/ugd/94ea38_51149d0779de417ea183fbf22a757cc9.pdf?index=trueIn PDF document text
    • https://dcc20dec-0195-4543-b617-cfb82efd15f0.filesusr.com/ugd/30ea26_671d7d876df643359e6157b48061910e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d103504-844f-43d2-ad82-72d35d60cbe8/how_to_get_auto_repair_license.pdfIn PDF document text
    • https://033a7475-7ccb-45c1-8f1e-38fd320d48d0.filesusr.com/ugd/03a576_398f8360d16749b1a691761327547b2e.pdf?index=trueIn PDF document text
    • https://ea7788ad-ef5a-48b5-911d-3ad522045378.filesusr.com/ugd/f3bfbb_521d6fd5ece64eefaa5c6e52aaa53b7a.pdf?index=trueIn PDF document text
    • https://fb7bf4c5-056f-4058-a7d1-073478569b53.filesusr.com/ugd/d90490_0bf0fb39bc9b49a1998993305f8edf98.pdf?index=trueIn PDF document text
    • http://fugufaza.myartsonline.com/ingersoll_rand_ssr_ep_150_air_compressor.pdfIn PDF document text
    • http://namepafubi.atwebpages.com/64961869449.pdfIn PDF document text
    • http://pasexojubil.epizy.com/how_to_identify_a_marvel_schebler_carburetor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/833bb644-3110-4454-b5d9-23daa886ce68/93660096376.pdfIn PDF document text
    • http://perexuwofogefo.onlinewebshop.net/how_to_reset_esi_phone_system.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012c61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C61 23184 bytes
SHA-256: 9b3f50fa74defdf882c0733ef477fde66f21b3f03d75c2bb3a71b07fe7c96d05
font_01_sfnt_off0001760d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1760D 5104 bytes
SHA-256: be28e4c586235f355000808d779aed299ccd12fec357d0e27cfeccc027b6d58e

Open this report in the interactive analyzer, or submit your own file for analysis.