Malicious PDF — malware analysis report

Static analysis result for SHA-256 e42763d4f6755f3a…

MALICIOUS

PDF

88.6 KB Created: 2021-03-23 03:26:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 34d5e5ff6e924fc3d34acead1b3447a3 SHA-1: 16697b0ec2cf6652f12c6b97e4d48bdd6e245be4 SHA-256: e42763d4f6755f3ab6774bcee367f1a0a40bd6ddd4002a1434e26b93d939d5f4
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=hsc+routine+2016+dhaka+board PDF link annotation
    • http://fogafiv.mypressonline.com/65628667354.pdfIn PDF document text
    • https://cdn.sqhk.co/muzolorakow/jBDDrhd/ball_sort_puzzle.pdfIn PDF document text
    • http://rigoditibalun.mywebcommunity.org/saxuluvirig.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427504/normal_604e5dc339f62.pdfIn PDF document text
    • https://cdn.sqhk.co/gebitasixa/Exzjfgj/42214990898.pdfIn PDF document text
    • https://cdn.sqhk.co/leguzufaju/uigUiip/catch_the_candy_mech_2_game.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381321/normal_604b06f428a2c.pdfIn PDF document text
    • http://kixurox.getenjoyment.net/dapanafekuvez.pdfIn PDF document text
    • http://finoginujowiwi.mypressonline.com/a_single_shard_chapter_12_summary.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404515/normal_6057aa6c1f257.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369923/normal_5fff27944f6dd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://e668d0bc-6b9c-4787-ac64-5363b724ef62.filesusr.com/ugd/6ec699_b09a6069e30043399f9189127038ebed.pdf?index=trueIn PDF document text
    • http://jabodegodonirad.atwebpages.com/94370728829.pdfIn PDF document text
    • http://bajupigirosinaf.atwebpages.com/cambios_sociales_en_la_vejez.pdfIn PDF document text
    • https://s3.amazonaws.com/vabedafozo/conservation_of_mass_activity_worksheet.pdfIn PDF document text
    • https://21d44941-995c-48b9-956b-8145330e20d5.filesusr.com/ugd/577b75_626bd5b52d684037868af740d672a0d1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pasawe/24338338764.pdfIn PDF document text
    • http://panexorumilogim.myartsonline.com/tl-wr841n_firmware_upgrade.pdfIn PDF document text
    • http://kijonag.onlinewebshop.net/bus_eireann_youghal_to_cork.pdfIn PDF document text
    • https://d6aab468-caab-4d9e-910f-d3bf64ae4104.filesusr.com/ugd/5438e3_935049f47a7240449dccf0726f976003.pdf?index=trueIn PDF document text
    • http://kijonag.onlinewebshop.net/jifiwuboxiwov.pdfIn PDF document text
    • https://04934832-22f3-474e-96de-b9d593e92251.filesusr.com/ugd/f390e7_f498d5f9ce3c4271b67bbaf7bf9dcce8.pdf?index=trueIn PDF document text
    • http://bajekixizosi.myartsonline.com/25932949125.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f536.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF536 5640 bytes
SHA-256: 92494248da7e1450d9d458879ec1e6419a9fd5a76cf57fcf9acc4684862298fe
font_01_sfnt_off00010854.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10854 12924 bytes
SHA-256: 594a432faaed4a328097c550c5425e8162892b880dbc7716bea5143859b04546
font_02_sfnt_off00012f58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F58 10852 bytes
SHA-256: 3036bbc37879908287bb282fab546f99ca9bae728a3348090d0156fdb06ea705

Open this report in the interactive analyzer, or submit your own file for analysis.