Malicious PDF — malware analysis report

Static analysis result for SHA-256 d20a4304235ca9d1…

MALICIOUS

PDF

81.9 KB Created: 2021-05-02 05:47:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: dee7916a34c6de4cf45d5f9102f2bcc2 SHA-1: b240580ed151a678111918fa0fa493d654bab523 SHA-256: d20a4304235ca9d1724b99bec8fb50f8618b001f691270331d9b85fdb4260188
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=kenmore+dryer+model+110+parts+diagram PDF link annotation
    • http://scarcebook.com/daxipovekijafesopusevd55t0.pdfIn PDF document text
    • http://1fps.ru/2494179342jczus.pdfIn PDF document text
    • http://faceit.su/8930364550m7tmg.pdfIn PDF document text
    • http://zelopaqq.xyz/62168902304inull.pdfIn PDF document text
    • http://alteramaks.world/413213479467t67v.pdfIn PDF document text
    • http://andyhong.blog/calendario_academico_ucm_ciencias_de_la_informacionmm1u6.pdfIn PDF document text
    • http://antileqphh.site/5th_grade_trivia_questions_and_answersbtjp1.pdfIn PDF document text
    • http://tesar-krd.ru/17910102311yn4id.pdfIn PDF document text
    • http://zoosalon.org/98838805868759yq.pdfIn PDF document text
    • http://shoppermarket.online/graphic_design_internship_melakauxv4o.pdfIn PDF document text
    • http://strgb2.ru/wosedekitufumuwakezosormop6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/dd5f894d-db48-4ed4-9fbc-434acee81143/how_to_save_tableau_workbook_as_older_version.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3685eb4-dd3d-4d64-997f-9a1aa0689155/13128674378.pdfIn PDF document text
    • https://s3.amazonaws.com/wuwabobujasivor/leg_ulcer_management_guidelines.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3ede41c-746d-43fb-90e1-4d718803e6bc/56964947666.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d2b5126-4194-4823-9af8-71adef99487d/ranger_boats_near_me.pdfIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/ratovof.pdfIn PDF document text
    • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_b3c690456662487fbbed198c80c400ff.pdf?index=trueIn PDF document text
    • https://550dfcec-0280-4316-a0d5-68b74a7a20b9.filesusr.com/ugd/f59309_1e2a8897164340a3a0a6f3c2225c4f33.pdf?index=trueIn PDF document text
    • https://9f53eded-325d-4e02-8430-7c09bd872488.filesusr.com/ugd/e04405_815cbbc376344f10b0e3a0592681caac.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/61883417800.pdfIn PDF document text
    • https://s3.amazonaws.com/sesijesule/5025897506.pdfIn PDF document text
    • https://53860ffb-5975-4088-b838-5c82367c2827.filesusr.com/ugd/0d2908_4440f60e9f58488ea1df69084bc967af.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2A7 5332 bytes
SHA-256: cfd9c2321c707f657637e5cf2d966dfc6e0ce5ada038a19686b074140c180013
font_01_sfnt_off000104b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104B8 11356 bytes
SHA-256: 7085077ce0cb17103ad99665150902a5da706ab762a4e7ce0aedc60d46c2aac0
font_02_sfnt_off00012bc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12BC5 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.