Malicious PDF — malware analysis report

Static analysis result for SHA-256 d168465a124d2691…

MALICIOUS

PDF

77.6 KB Created: 2021-03-23 15:42:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a11275ced4b4e491e77019adffbc12a7 SHA-1: 97e8fc81a3b1167b92a3b88c1c2650530f48859b SHA-256: d168465a124d269191dd3e2a1eb173657f191ef095028f206d3ad8b9274a3d65
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=myers%2527+psychology+for+the+ap+course+third+edition+pdf+free PDF link annotation
    • http://tryporte.xyz/32195955527poomn.pdfIn PDF document text
    • http://help-feedback-amzn8.xyz/sheet_street_beach_towels3cnhi.pdfIn PDF document text
    • https://milonotupilo.weebly.com/uploads/1/3/5/3/135347339/4e977b7e1f.pdfIn PDF document text
    • https://cdn.sqhk.co/kufalavoxig/cghiege/sukopixiputagidug.pdfIn PDF document text
    • https://tukumexof.weebly.com/uploads/1/3/4/7/134721389/mureledurak-nabatap.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378167/normal_600c9a5a3e8fe.pdfIn PDF document text
    • http://cookwellbakewell.com/lemofubokumekojonafu7tjvo.pdfIn PDF document text
    • https://neruwutuwi.weebly.com/uploads/1/3/5/9/135960217/tozali-gaxopo-lefiwojuzufan-vekufevuzupe.pdfIn PDF document text
    • https://cdn.sqhk.co/zarepowake/dogdXic/97837213928.pdfIn PDF document text
    • http://eeeeeyyy.space/wafabotogiusajt.pdfIn PDF document text
    • https://cdn.sqhk.co/ponajadu/iOgfDB3/ccavenue_payment_gateway_for_android.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422890/normal_60251e263f540.pdfIn PDF document text
    • https://cdn.sqhk.co/nezerozara/64geWQZ/cavan_farm_machinery_show_2020.pdfIn PDF document text
    • https://zizopozuwugova.weebly.com/uploads/1/3/0/7/130775786/2923565.pdfIn PDF document text
    • https://cdn.sqhk.co/wuzosiboweja/gJ3ghA2/dual_outgoing_message_answering_machines.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419003/normal_5ffe0921cfeea.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366336/normal_5ffe95d08602e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392207/normal_5fccb779c3e7c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://46c19374-600d-43be-a5f2-d8bf07c6fddf.filesusr.com/ugd/cc94a4_021d18dfbe8c48a2a1607ae25e8e41c2.pdf?index=trueIn PDF document text
    • http://nogobixa.epizy.com/vebuxasodelivomuw.pdfIn PDF document text
    • http://wojodiguf.rf.gd/74895460799.pdfIn PDF document text
    • http://zaxukesaludu.epizy.com/free_cognitive_worksheets_for_kindergarten.pdfIn PDF document text
    • https://7d33af4c-acfd-4996-9436-348e89828b5b.filesusr.com/ugd/289672_5d7fc86a09a34be7836ab186e6d62f47.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE19 5560 bytes
SHA-256: 7a23cbbf52894ef843e058e27f5eed5f9c3bd6660673e82aeae0a23600b1547a
font_01_sfnt_off0001011b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1011B 11596 bytes
SHA-256: d5911152761f1134a23a41aa0d62340922fde9967d92a292e210d08d138e09fe

Open this report in the interactive analyzer, or submit your own file for analysis.