Malicious PDF — malware analysis report

Static analysis result for SHA-256 d713160107a225f3…

MALICIOUS

PDF

78.3 KB Created: 2021-04-30 11:02:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a2eed5f128d74824166d580ec687e185 SHA-1: 1b5471b8067ac104553a32da9eabc3a279c1fa98 SHA-256: d713160107a225f3f77ac442a94e47f331a51ab48503d9bd7adc07df1a9ad750
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=what+is+the+best+cordless+waterpik PDF link annotation
    • https://lalinixew.weebly.com/uploads/1/3/4/2/134265361/kuvonavesade.pdfIn PDF document text
    • http://tevutubiwij.getenjoyment.net/cards_against_humanity_cards.pdfIn PDF document text
    • http://vlada4.xyz/hoverboard_in_store_pick_upentpt.pdfIn PDF document text
    • http://hangookoil.ru/matlab_2019b_download_sizenv9x3.pdfIn PDF document text
    • http://azorocheat5.xyz/zodamalemidezurizarvup33.pdfIn PDF document text
    • https://vobilazi.weebly.com/uploads/1/3/5/3/135300702/8067849.pdfIn PDF document text
    • http://onlyforyou.space/wufebipobotivituluwiopjdg.pdfIn PDF document text
    • http://legalvictory.group/kujenitenigolew1o4pz.pdfIn PDF document text
    • http://workshop-fb.ru/3641425983jztrm.pdfIn PDF document text
    • http://wide-take.top/wosazobutinfd.pdfIn PDF document text
    • http://xumupizaxuto.scienceontheweb.net/technical_drawing_with_engineering_graphics_15th_edition_download.pdfIn PDF document text
    • https://kobetuditi.weebly.com/uploads/1/3/4/4/134446504/neselunof.pdfIn PDF document text
    • http://stassikorskyi.com/3304482216yhikk.pdfIn PDF document text
    • http://wowitaly.space/76175695137ub779.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec5382ba-2529-44ea-82ea-57f33cc03789/xosomunujubivina.pdfIn PDF document text
    • https://31c8a3d4-0132-49f1-a04f-09c79d03e01f.filesusr.com/ugd/a4da84_da3f5929c6484efeb9c161dbce52facc.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/370f1de0-ac47-4cb5-99a3-774690303806/how_many_hotels_come_in_monopoly.pdfIn PDF document text
    • http://ludugatitabi.atwebpages.com/bertrand_russell_religion_and_science.pdfIn PDF document text
    • https://ddb0fe67-a09a-413d-b59a-c21b1dde3186.filesusr.com/ugd/3f0e57_ba14720b5d4f446aa9447b83629cad36.pdf?index=trueIn PDF document text
    • https://be9ca920-c372-4566-b00d-544f92814f3b.filesusr.com/ugd/f0c5a9_507ccbaf11124c328f72d4dce153f18a.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f45b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF45B 5468 bytes
SHA-256: 5653564ea9f4e692c44153b0615e79bb5da6e4842460ee17ae28ffc9e84b5900
font_01_sfnt_off000106fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106FD 10792 bytes
SHA-256: b496d741b59a2d673bba1945dffacf9163741cd4f68f211e8ad3aa58fee9869a

Open this report in the interactive analyzer, or submit your own file for analysis.