Malicious PDF — malware analysis report

Static analysis result for SHA-256 d44ffd983e946477…

MALICIOUS

PDF

79.6 KB Created: 2021-04-26 15:14:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: db7ec84c8283cfe7080dc6f550b2c90f SHA-1: b39c0bfee7545a9df76b576003847c232c44807c SHA-256: d44ffd983e946477ccac8d02ff0e2744f548ee6d9bc469a0c31c5d55f2e1cab6
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=how+much+do+babies+sleep+at+4+months PDF link annotation
    • http://bumululoru.mywebcommunity.org/toduwobabefewed.pdfIn PDF document text
    • https://cdn.sqhk.co/tivinarafuvu/gj0kGig/xisonofuvunoweporilapiwu.pdfIn PDF document text
    • https://bevozuvegala.weebly.com/uploads/1/3/3/9/133999301/9436806.pdfIn PDF document text
    • https://nakigere.weebly.com/uploads/1/3/4/6/134608851/wozebirav.pdfIn PDF document text
    • https://cdn.sqhk.co/bidelefo/gikgiub/bikeletatuzuteb.pdfIn PDF document text
    • http://novofikupeneda.mywebcommunity.org/xujojebabonixatodufujiwe.pdfIn PDF document text
    • http://nexofozupugasi.mywebcommunity.org/19365503536.pdfIn PDF document text
    • https://taxajoberaruvu.weebly.com/uploads/1/3/4/3/134320235/bccbfb.pdfIn PDF document text
    • https://cdn.sqhk.co/bujasugawo/iedUhb0/amazon_alexa_app_for_mac_os_x.pdfIn PDF document text
    • http://tobaliwono.mygamesonline.org/south_african_schools_act_summary.pdfIn PDF document text
    • https://lepekogiba.weebly.com/uploads/1/3/1/6/131637498/katorozikitof.pdfIn PDF document text
    • http://sugalomiwuto.getenjoyment.net/dawn_spelling_bee_word_list_2020.pdfIn PDF document text
    • https://xezixopizanew.weebly.com/uploads/1/3/5/3/135314636/7b970cc26c159e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/15ef8903-a48d-4bcd-a516-99c34475ceba/que_es_los_signos_de_puntuacion_y_entonacion.pdfIn PDF document text
    • http://nofolimuri.myartsonline.com/brochure_background_design.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ea59e8a-57a1-49f4-b10e-db20554f3ad6/nidexusonezi.pdfIn PDF document text
    • http://pupagerirawax.myartsonline.com/emotions_and_feelings.pdfIn PDF document text
    • http://dozopedatofol.atwebpages.com/95361427657.pdfIn PDF document text
    • http://pugazapuxijal.myartsonline.com/adding_ing_to_verbs_rules.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf4cc4f8-9474-4867-b76f-b343ce1e73ef/wowarusi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a9372fe-d46e-429e-98bf-caa985a7c956/49006766150.pdfIn PDF document text
    • http://kuwademepekipil.epizy.com/41315152283.pdfIn PDF document text
    • http://toguxekedufu.epizy.com/lozegepedunubawelugo.pdfIn PDF document text
    • http://todiwefexoneb.atwebpages.com/fapexaronoxevepodurogifas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c25fce9-72a8-45f7-9e0b-6807bc2cfd59/tirimowamizu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f850.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF850 5496 bytes
SHA-256: cbc8c796a51139d703558731ce8d339887a2c7524cf93f0602c4cc7d65a6a052
font_01_sfnt_off00010ae8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AE8 10976 bytes
SHA-256: befe3ff7dad1dcd7811bf9f07c941545c1e12d004952f3f17f978083e4b90ef6

Open this report in the interactive analyzer, or submit your own file for analysis.