Malicious PDF — malware analysis report

Static analysis result for SHA-256 d19ad34daa8548f6…

MALICIOUS

PDF

84.8 KB Created: 2021-05-29 14:09:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: d7d20970af87f31973d531060f20cbea SHA-1: 7294ebb6c9f8e78ceb91cfff2e954794a130ccd9 SHA-256: d19ad34daa8548f681fa6a9c759564da69d260b3b9f94d2bc2b4561e7b54035c
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=bleacher+report+raw+september+2 PDF link annotation
    • https://tiwebusimevadeb.weebly.com/uploads/1/3/5/3/135346158/4a5b25c.pdfIn PDF document text
    • https://dozogifelezu.weebly.com/uploads/1/3/4/3/134313369/nuguwer.pdfIn PDF document text
    • https://wazawuxara.weebly.com/uploads/1/3/4/7/134762715/rufutenuredeseno.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376609/normal_5fc916e182ea5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381964/normal_605a702040d0f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444357/normal_5feda0238050e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414339/normal_6060cc676a976.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6f0e443-fed3-4a0b-b91b-d9f9cb8a73c8/cuanto_es_200_mililitros_a_gramos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e648c21-f49f-4bcd-a3ab-760d70f39176/cuales_son_los_signos_vitales_de_un_recien_nacido.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1735272e-7ba3-4791-bb0e-d80f8cdbc106/how_to_tell_what_size_big_green_egg_i_have.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54e33ba1-b4d1-40d6-9f7c-0c4b097e3dbe/30829545389.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1b60136-a3e9-4065-8c07-b4e301171622/how_much_are_trampolines_on_amazon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97eb8a58-c551-4f69-8b41-2ec61d04bc63/lockpickinglawyer_best_lock.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1f677c7-7831-4341-ba66-68912568125f/xusavuxunovepavomotup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb964f7f-b3e0-47a8-8139-1cde9a1ec16e/how_many_pages_are_in_harry_potter_book_1_us_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c4a7a5e-b736-4db0-a9ef-a37d8eaa0791/33771120604.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f96f50b6-6c5e-403a-b4e2-5d669defd9b4/gre_quantitative_hard_questions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c1e5d9c-07e7-4aba-9dd1-68028f046249/what_is_the_dewey_decimal.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e90.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E90 5584 bytes
SHA-256: 88a725ab85d795200ffa479f898207439e921d66f7dad02eb0998d03b0bdb2d1
font_01_sfnt_off00012173.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12173 10760 bytes
SHA-256: 275903c5a9bb02226ca57c51ac01234a19d7796ed2a7e4ffb75f4baa7ca78324

Open this report in the interactive analyzer, or submit your own file for analysis.