Malicious PDF — malware analysis report

Static analysis result for SHA-256 e19dbb67f4113571…

MALICIOUS

PDF

82.5 KB Created: 2021-03-14 05:06:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-10
MD5: 5964654aa09b48d2e484172ae732422f SHA-1: b898695d93c5658573d65cce7b834f8d89fcc0e1 SHA-256: e19dbb67f41135715cdc2a2d39421fa56437a4188121aa9f508e22b78d5f0902
196 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=comcast+xfinity+home+security PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/godewumazek/84497591626.pdfIn PDF document text
    • https://s3.amazonaws.com/tibitexil/hasselblad_large_format_film_camera.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fed70222-368c-4ca2-978d-38a80d79a306/shark_sv780_pet_perfect_ii_18v_cordless_handheld_vacuum_manual.pdfIn PDF document text
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_0e09fcd4953b4a4fbd58427e70911624.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/188123e9-5125-486f-a4bd-4d32f5d12861/tatuweno.pdfIn PDF document text
    • https://144ece88-722e-4d59-a9d1-ae16887514c2.filesusr.com/ugd/48b17f_b5085e4ecdbc4e6b8db65d5c8b4e0a20.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tumuzu/bubble_picture_free.pdfIn PDF document text
    • https://s3.amazonaws.com/pokorevalaxex/free_cleaning_checklist_templates.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/acknowledgment_of_paternity_form_03pa209e.pdfIn PDF document text
    • http://wiwazisumi.rf.gd/how_do_cheques_appear_on_bank_statements.pdfIn PDF document text
    • https://s3.amazonaws.com/gazijewevan/57937601838.pdfIn PDF document text
    • https://s3.amazonaws.com/wexukufedepim/garmin_forerunner_620_repair.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b5a364d-b2d4-41ab-92a7-ca25c06adcdd/pose_method_of_running_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/556fbd0e-c9ca-4c88-b3a7-8ebdc81c6e9c/honda_eu2200i_parts_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/tazopaju/alinta_energy_solar_pv_application_form.pdfIn PDF document text
    • https://s3.amazonaws.com/zozuxukoxo/mirax.pdfIn PDF document text
    • http://sowituzujove.rf.gd/lusumijomadudojafakawidas.pdfIn PDF document text
    • https://s3.amazonaws.com/fosalizuzu/uniformly_accelerated_motion_l_g.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010420.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10420 5164 bytes
SHA-256: 5093595e828a4cd48d960d9e60354a4149fc57a04a0a5671191a96d2fe92d5c6
font_01_sfnt_off00011590.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11590 11628 bytes
SHA-256: d4ebcd753a9140d50cb747932ff23c7c2ee0e68d1741ed7a6a43b79f93387805

Open this report in the interactive analyzer, or submit your own file for analysis.