Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2df37cb8d437ac6…

MALICIOUS

PDF

72.7 KB Created: 2021-05-27 16:43:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 655441cd458a173cb78b822033176ced SHA-1: 0325a20797bf960cc0da121ffa3ab2835dd15b2c SHA-256: e2df37cb8d437ac693630960d1fdcffc9deacaa7fe31b784743a5694038dab23
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9871

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=calor+cedido+y+absorbido+por+los+cuerpos+wikipedia PDF link annotation
    • https://tofesasezi.weebly.com/uploads/1/3/4/7/134730688/ae26b337fed8f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384633/normal_604ee7ba25ad1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408475/normal_60695c2dcf89f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485568/normal_6016c1546f643.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410432/normal_604f986da7d57.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409420/normal_5ffc9a1fb5b39.pdfIn PDF document text
    • https://lefatelaxebaj.weebly.com/uploads/1/3/5/3/135398996/7756147.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470977/normal_5fdbfb5e847e3.pdfIn PDF document text
    • https://faruxolumapegi.weebly.com/uploads/1/3/5/3/135341403/481001599cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405895/normal_603ea9091c69c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451377/normal_60160797a5ab7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427295/normal_5fe14bd3d72f9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365601/normal_6030d51718f29.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365606/normal_5feb3c0d5c5e4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4391602/normal_5fe3cd03f064d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424991/normal_605efe80e5206.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407788/normal_60187a8976e4e.pdfIn PDF document text
    • https://libakitaxejadeg.weebly.com/uploads/1/3/4/0/134096258/7bb6a86c.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • https://uploads.strikinglycdn.com/files/e0c884ed-60a9-49e3-b9d7-9e2633be61ec/25079219523.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ad01678-7872-4f28-9d58-b0519c871c3e/69965467567.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c06a460-8233-4e90-a626-f2bec6c28668/what_number_do_i_call_to_report_my_ebt_card_lost.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/193f542f-f1f1-4ceb-80fa-b9a30d8b3f6d/how_much_does_tivo_lifetime_subscription_cost.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd63b0f8-1bf2-4c1b-9fd5-993a1312d680/what_is_the_least_common_name_in_the_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a255750-fc97-48cd-b25d-f750858622cf/27111532097.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97c9ee31-f52c-4027-9483-be91e00d605d/tijasakovotozotalixisazi.pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011363.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11363 1780 bytes
SHA-256: f0ecb3a1344382c5382a8312aa0e1d8de189da64c05aa8bbd3f74a8be1d623de

Open this report in the interactive analyzer, or submit your own file for analysis.