Malicious PDF — malware analysis report

Static analysis result for SHA-256 e15b8e42391db63a…

MALICIOUS

PDF

83.9 KB Created: 2021-03-25 04:50:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: bacc18795d252d9c196691e70eaf1017 SHA-1: d7deb38cc47ea91852f4636d9a263bb46ccafd55 SHA-256: e15b8e42391db63a12c88f49e6bb32fae0c2a0ecd9e117f71f1e7c933464e160
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=java+inheritance+interview+questions+and+answers+pdf PDF link annotation
    • http://kungfumalibu.com/rowepakakokegutajowutccyqa.pdfIn PDF document text
    • http://cz-nitrof.website/poxumupazewokiwijecvos.pdfIn PDF document text
    • http://medebupima.sportsontheweb.net/what_are_burger_king_fries_made_out_of.pdfIn PDF document text
    • http://zememor.sportsontheweb.net/carbon_steel_material_properties.pdfIn PDF document text
    • http://xofelivigavas.mywebcommunity.org/jubaxi.pdfIn PDF document text
    • https://xonuvalax.weebly.com/uploads/1/3/1/4/131437330/8768033.pdfIn PDF document text
    • http://xibiselid.medianewsonline.com/mrc_dyspnoea_scale.pdfIn PDF document text
    • http://samelike.site/66045806573x3f3w.pdfIn PDF document text
    • http://specialsale.info/sociology_word_search91tn7.pdfIn PDF document text
    • http://citimart.online/arteriovenous_malformation_of_uterusidb9i.pdfIn PDF document text
    • http://martakkord.ru/taylormade_r15_driver_price_new4y2d0.pdfIn PDF document text
    • http://midikakuvekume.mywebcommunity.org/analyzing_financial_statements_8th_edition.pdfIn PDF document text
    • http://salonly.xyz/panasonic_microwave_oven_nn-sd372s_stainless_steel_countertophcefp.pdfIn PDF document text
    • http://sepoxudozixo.sportsontheweb.net/76094512921.pdfIn PDF document text
    • https://zetitazafoxiz.weebly.com/uploads/1/3/4/0/134040412/9637514.pdfIn PDF document text
    • http://pet-guru.shop/jarujoxapizelejefd1pc8.pdfIn PDF document text
    • http://marketitaly.info/minecraft_dome_schematico8l2z.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://59b17237-83b3-47c6-9d40-f547da5b0434.filesusr.com/ugd/827194_1d69910f22ca40708ae4ceaa6dac52ad.pdf?index=trueIn PDF document text
    • http://zonurupadul.atwebpages.com/sofejesojisebufakuvas.pdfIn PDF document text
    • http://nununad.myartsonline.com/xufabedinekukada.pdfIn PDF document text
    • https://d0bf7e8b-5449-41c0-93e9-161603c0719f.filesusr.com/ugd/197ed4_3540d097454e4e749ec424450433c450.pdf?index=trueIn PDF document text
    • http://kewetanetoza.atwebpages.com/english_grammar_worksheets_for_grade_2.pdfIn PDF document text
    • http://rixigor.onlinewebshop.net/embed_animated_gif_in_indesign.pdfIn PDF document text
    • https://02664c88-84e5-42fa-aae3-682d3a0d4328.filesusr.com/ugd/39d081_6f946b96168d400eae9b97d81048a4e4.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010af7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AF7 5476 bytes
SHA-256: df4155bc90d450a472127a5357a87829a671a9632095e055a6fcb64c9c0ac783
font_01_sfnt_off00011dac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11DAC 10924 bytes
SHA-256: 93eb4c9655b10a19ed4d2c22e5083019903007cdd66ead118d80e389b9bfa686

Open this report in the interactive analyzer, or submit your own file for analysis.