Malicious PDF — malware analysis report

Static analysis result for SHA-256 db4df5485fbe011b…

MALICIOUS

PDF

83.2 KB Created: 2021-03-16 04:41:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 71fdd7562b41416a585945c3f5598384 SHA-1: e6ab9df751979364bee387c11eb1586667fa15fd SHA-256: db4df5485fbe011b0f383ca24b97fb3c598b7f3337c6c92a39e95536d2bc8ade
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=quran+recitation+with+translation PDF link annotation
    • http://bezivodediz.iblogger.org/sowobipalubobej.pdfIn PDF document text
    • https://cdn.sqhk.co/fenazijeguk/eOAAhjO/when_i_will_die_who_will_cry.pdfIn PDF document text
    • http://jorowelumupikom.iblogger.org/fexejijew.pdfIn PDF document text
    • https://cdn.sqhk.co/lididiregi/72hbkim/llama_pinata_cake_topper.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wovisak/10196803269.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c5298e1-2539-45d9-af74-42766b62d487/giwedarikamovug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92ab756e-410c-41f2-a148-0e2debe24370/plot_summary_worksheet.pdfIn PDF document text
    • http://sekovukubetib.epizy.com/mk11_fatality_guide_ps4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f8eb9fb-e7b9-4051-aac6-5849f2366774/how_to_pair_turtle_beach_stealth_600.pdfIn PDF document text
    • http://nuvitaros.epizy.com/cat_mario_2.pdfIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/here_i_am_lord_clarinet_sheet_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56bb4318-af45-4385-8df8-1eafe0c83b24/mimut.pdfIn PDF document text
    • http://robexekipojop.rf.gd/daily_behavior_chart_template_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jalasilunaz/degazowes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b69986e-40d4-453e-86b2-0f15234ed756/pebaluwuvazobogotuxumi.pdfIn PDF document text
    • http://nipuvaxakaxini.epizy.com/42710951832.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e088f4c-3779-45d7-b6e0-df7bce755d6d/samsung_galaxy_s9_plus_screen_protector_nz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce97a5ce-3dbd-4012-b16f-32082e21eb4c/jutabodajivimuteduke.pdfIn PDF document text
    • https://s3.amazonaws.com/zufaxepixiguxax/cido_nitroso_formula_y_nomenclatura.pdfIn PDF document text
    • http://popadugabi.rf.gd/69852872693.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19de1204-7b8c-48e4-8ad4-8061a7a7143e/lean_canvas_template_google_docs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c03b1e24-0a61-47ec-9b68-c327c41ca66c/what_numbers_mean_in_dreams.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e22d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE22D 5040 bytes
SHA-256: ab72079eca30b9c723c70489f39c1056b35d9621e0f43032566a056ab2f3012e
font_01_sfnt_off0000f358.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF358 10472 bytes
SHA-256: 1c92ee74d201647a5ee98863523ea8e5179e3dca6ead5f70f0c36b26b6e20a16
font_02_sfnt_off000116c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116C2 22836 bytes
SHA-256: 9282499e89d92a2249a4c5b1ae63f00142e78b9d2c81e2ff0d6df2542610eb02

Open this report in the interactive analyzer, or submit your own file for analysis.