Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4d7e898987d0c3b…

MALICIOUS

PDF

76.3 KB Created: 2021-03-13 20:18:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: eeeca23a62193020496b110977e61777 SHA-1: ccc542513fc055ad1235673bddf76e7509fe55d8 SHA-256: d4d7e898987d0c3b1016d26eaaa4db6f516ab7bb5c892f456dbff4aba282ab24
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=objective+banking+awareness+questions+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4477173/normal_5fe79f5a5a860.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482189/normal_6038c5cbe6e10.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384633/normal_603caa3df11de.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469143/normal_60475839d9b77.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489237/normal_60149714a569d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409114/normal_5fcbbdb9cd429.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/282a5d54-f2e6-4033-800a-fc0c3fd14feb/pisenelewotapekazigixeloz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfaeabed-c75a-4485-9626-e9243268f962/wd_my_passport_ultra_does_not_showing_up_mac.pdfIn PDF document text
    • http://zogirifo.epizy.com/android_one_devices_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1f96aee-8c98-493d-92d0-5b14b3fcd7b0/24353979552.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c2f9761-f7e1-4ec7-ae7a-c40dfa76de11/26997513759.pdfIn PDF document text
    • http://bojibag.epizy.com/5315339060.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3db3c61-2945-446e-9d7f-c20eac4807bc/miss_peregrines_home_for_peculiar_children_2016.pdfIn PDF document text
    • http://wuwovedivaz.rf.gd/frigidaire_-_retro_1.6_cu._ft._mini_fridge_-_pink.pdfIn PDF document text
    • http://tifureboriva.epizy.com/nifowofofaniro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4cfe1e17-a2f4-416d-a089-8aea18b9336d/ketukor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbbcc1ff-c251-4f91-a0a1-fdd4c2a647f3/apple_ipod_video_30gb_battery_replacement.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a587267-b32b-48fa-a6f2-f462386581ae/healthy_bulking_meal_ideas.pdfIn PDF document text
    • https://be08d7d4-326a-4801-be9d-4496af17a43b.filesusr.com/ugd/d31907_0696108564c5474a9e2cf386a7e4cc8e.pdf?index=trueIn PDF document text
    • http://zinejamobasuwul.epizy.com/52208330346.pdfIn PDF document text
    • https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_4a9069a19ae24aea88d481cfa5e8ba80.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd70be0c-2d66-4c6a-9038-9786035e27fa/ford_mustang_mach_e_gt_performance_price.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f265.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF265 5876 bytes
SHA-256: b8e68d8faf430148ffb850e60684941f9aec8a56f1ee0880a0ff8bec7aba14d6
font_01_sfnt_off00010681.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10681 10688 bytes
SHA-256: ad4d10f65fce598d3be8a6bf3840d8ba634f717502d907e7eb39ac11d47ee027

Open this report in the interactive analyzer, or submit your own file for analysis.