Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbf4c25ae5e88337…

MALICIOUS

PDF

67.8 KB Created: 2021-03-23 04:10:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: d1350226d82862b92bdd1f50ee2acab8 SHA-1: c7f0bdad3c3c06ca349fe8fcdb779bcc317e5a4e SHA-256: dbf4c25ae5e88337745c5abdb5e864efa0d2ed9812f701e7bfb5c6a352488927
224 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains multiple links to disposable domains and known malicious redirectors, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The presence of 'cmd_list_files_with_extension.pdf' in the document text hints at potential execution of commands or exploitation of vulnerabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/123?utm_term=jquery+datepicker+bootstrap In PDF document text
    • http://steh-sistem.ru/motores_de_corriente_directa_y_alterna2tyy2.pdfIn PDF document text
    • http://wegaturagifo.getenjoyment.net/gexedufixop.pdfIn PDF document text
    • http://natorg.space/go_climb_the_treasure_mountain_poemig70r.pdfIn PDF document text
    • http://cesaregaspari.com/what_do_vegans_eat_for_mealshk0p5.pdfIn PDF document text
    • http://gedadekenoz.mywebcommunity.org/xamimaru.pdfIn PDF document text
    • http://bomaduworofa.medianewsonline.com/windows_cmd_list_files_with_extension.pdfIn PDF document text
    • http://paxabak.mypressonline.com/merchant_of_venice_act_1_scene_2_workbook_answers.pdfIn PDF document text
    • http://zuwazekanusur.mypressonline.com/26181304228.pdfIn macro / runtime command snippet
    • http://arendaavto.taxi/machine_learning_and_ai_salary_in_indiaalhxn.pdfIn PDF document text
    • http://kulotufiw.mypressonline.com/woliwu.pdfIn PDF document text
    • http://ziposodepow.mywebcommunity.org/factor_analysis_and_cluster_analysis.pdfIn PDF document text
    • http://rozewevojalel.sportsontheweb.net/how_hedge_fund_get_money.pdfIn PDF document text
    • http://paxabak.mypressonliIn macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://katibabiziv.epizy.com/fm_global_product_approval_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/514c8e64-bf03-4364-aa93-00f73e17e929/23577339875.pdfIn PDF document text
    • http://tafiwepamubov.atwebpages.com/77871189648.pdfIn PDF document text
    • http://gurabagoderes.atwebpages.com/thomas_calculus_11th_edition_full_book_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f18f9688-d21a-4a4d-af0b-77e9bb75a0f5/fodudo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06d4b2a6-2ffb-4685-8a3d-e0ca6c8c74a0/on_the_concept_of_history_walter_benjamin_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a803d3a-903d-41f3-b84b-a5d0ca1cfb13/how_to_use_macbook_air_2019_for_beginners.pdfIn PDF document text
    • http://xikusizaferawev.rf.gd/how_to_fix_john_deere_hydrostatic_transmission.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce9c3732-e306-41f7-8318-ea0dc2bcd14a/libro_azul_2021_gratis.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB02 5456 bytes
SHA-256: 6e8cdcabec3508aac290772437075a4e99888048833a12fd8253a31a857de211
font_01_sfnt_off0000dda1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDA1 10308 bytes
SHA-256: f3aa4ca4fa5466bec84c9c8c9a7dea82cf6cbbb3fe38fe72a8aa755a644ecc55

Open this report in the interactive analyzer, or submit your own file for analysis.