Malicious PDF — malware analysis report

Static analysis result for SHA-256 d478eb51ea4b593b…

MALICIOUS

PDF

83.8 KB Created: 2021-04-01 10:48:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f5ecd64dd47bc0c1e6f6bccb51b848ad SHA-1: 148a6cd04cf4ae9fa5f1a5ffe996ef8b15665518 SHA-256: d478eb51ea4b593ba154fa194bee1c896d1b12f727e6c16d321b1910d15ee0e5
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=is+it+dangerous+to+listen+to+music+while+sleeping PDF link annotation
    • https://cdn.sqhk.co/mawedabe/ggi6xii/winedojitetigam.pdfIn PDF document text
    • https://cdn.sqhk.co/makulowujip/jfjgr0c/96662649264.pdfIn PDF document text
    • https://cdn.sqhk.co/riwifesineji/BBKjiQ6/dead_effect_2_mod_apk_and_obb_download.pdfIn PDF document text
    • http://bcpzonasegura10beta-viabcp.com/windows_10_pro_free_download_64_bit_with_crackvxj3x.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392462/normal_603f30e41bb5b.pdfIn PDF document text
    • https://cdn.sqhk.co/tosuwukiwate/0YhdGDF/diy_mask_extender_no_sew.pdfIn PDF document text
    • https://cdn.sqhk.co/pedajobu/Akhc3ic/quadratic_equations_worksheet_grade_7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494888/normal_602ab4bf29fa0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384046/normal_5fc71b121b2fb.pdfIn PDF document text
    • http://okrasote.info/factoring_worksheet_algebraw5g09.pdfIn PDF document text
    • https://cdn.sqhk.co/jinuzekovodi/djhzMjd/candle_light_video_song_hd.pdfIn PDF document text
    • http://strapslap.online/bob_marley_greatest_hits_album_downloaddrr6a.pdfIn PDF document text
    • http://jidevutijosu.iblogger.org/pebavo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403688/normal_603af257ce122.pdfIn PDF document text
    • http://particulier-societegenerale.xyz/technology_stocks_to_buy_indiao907c.pdfIn PDF document text
    • http://biraxubidu.22web.org/does_the_garmin_drive_52_have_free_map_updates.pdfIn PDF document text
    • https://cdn.sqhk.co/pivokazi/hjhogiE/pamugegokil.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://numapev.rf.gd/bagubi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b81705e6-f14a-44f9-9c3d-b1c5ce916e72/24301917505.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7d91211-9dbe-4b41-8caa-630049f96553/66076082020.pdfIn PDF document text
    • http://petekukeseji.rf.gd/chakka_bajana_patalu_video_songs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42f09415-cb94-464d-9230-df566e9fd59b/streetcar_named_desire_movie_vs_play.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56960df7-f520-4fa4-8169-2874c29c2fd3/the_adventures_of_huckleberry_finn_book_cover.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c6de9de-8a23-4b8a-b573-3ed99ba0f5ae/babege.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010898.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10898 5516 bytes
SHA-256: 673d7ce660ebdeaba32c3ae24a8e98cdfe70b5ae81ec4bc2800a257091449d9a
font_01_sfnt_off00011b3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B3F 11096 bytes
SHA-256: f822558ab6d122b86acdf4dd34357b6516da1ff319ca3611d0a094a75b6e46e1

Open this report in the interactive analyzer, or submit your own file for analysis.