Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6a0252df9dedb03…

MALICIOUS

PDF

78.9 KB Created: 2021-03-11 22:04:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: ab55e7c9ecb79c41daa6e988fa3f8f63 SHA-1: 75b2239a8dae72b0ee65c746551ac651896c9ea1 SHA-256: d6a0252df9dedb03c104f04c6fa075b7e1550fe8df6f486d57e02f8904e5c470
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=commando+4+game+free++for+pc PDF link annotation
    • https://cdn.sqhk.co/xunijejozi/qgLAwjb/greek_hoplite_warfare.pdfIn PDF document text
    • http://instapriz365.site/the_chronicles_of_narnia_prince_caspian_english_subtitles_free_download7cw34.pdfIn PDF document text
    • https://cdn.sqhk.co/dofexoxev/dgiYian/movies_anywhere_codes_generator.pdfIn PDF document text
    • http://nutusugeralinet.mypressonline.com/88976249209.pdfIn PDF document text
    • http://lewijufe.sportsontheweb.net/oxford_biology_dictionary_download.pdfIn PDF document text
    • https://cdn.sqhk.co/pemenixa/iiijchj/50898179368.pdfIn PDF document text
    • http://suvekitubexeso.getenjoyment.net/jirikob.pdfIn PDF document text
    • https://cdn.sqhk.co/vovewotutal/ghtijjd/mupajota.pdfIn PDF document text
    • http://mufutekuson.getenjoyment.net/how_do_you_reprogram_a_white_rodgers_thermostat.pdfIn PDF document text
    • http://eushopvmn.site/36514653153iaqd2.pdfIn PDF document text
    • http://circus.market/butemixodhokrh.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bitines.myartsonline.com/how_to_find_lim_fx_as_x_approaches_infinity.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0db8d4bc-9e67-4805-8c80-0b11cf08304a/persepolis_marjane_satrapi_summary.pdfIn PDF document text
    • https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_44a1906006b64ff3b81927830942b347.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c16da65f-effe-4f5d-9021-b2aaebf5ae67/twilight_saga_dvd_box_set_walmart.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc01dfa0-49d8-430b-aacb-fe548287064b/john_deere_125_automatic_snow_plow.pdfIn PDF document text
    • https://c33c3ce4-fa2f-4f19-9477-7a801b41b29e.filesusr.com/ugd/ebbcbd_1c20bb96e485491f88d4f04129ae8bd7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb2422ab-e35c-46b5-935b-d3abe7e1b3fc/tigufopudaw.pdfIn PDF document text
    • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_e847e9f0bb134f9fb89e82bec93d0398.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e78278a3-1f4e-4d01-9449-3c12da15d7ab/who_came_with_the_bible_in_south_africa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f554187-3c12-4d1a-a5b7-d5e1f64d8aba/89928686015.pdfIn PDF document text
    • https://f733e552-90a1-4d1f-83ca-a6b36afcf31c.filesusr.com/ugd/38bf1f_e31b8b8052204a2cbfb43628946ecfdf.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f79a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF79A 5260 bytes
SHA-256: 11e5e2432bb9f355a49551a440453f8968948fa7234fd6d152e86feb105e59b1
font_01_sfnt_off0001096f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1096F 10784 bytes
SHA-256: 0a03ef2851ac0b753e1c810c6005d19dd2df3c04626a372b18df100a4872d4be

Open this report in the interactive analyzer, or submit your own file for analysis.