Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6a96051b97f1f6d…

MALICIOUS

PDF

77.9 KB Created: 2021-03-20 19:04:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: a88cb57394b4fb2607e325fa0663c85c SHA-1: d9894ac245f514f91bf7fc1bca1138f81dabee45 SHA-256: e6a96051b97f1f6df84efbf90a20e5f694dbe07428d632f16605981567b43868
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=geometry+dash+hack+apk+noclip PDF link annotation
    • https://cdn.sqhk.co/duputokodoz/e0thfji/memugadaxop.pdfIn PDF document text
    • https://cdn.sqhk.co/wikelere/ljdgehi/fapepexubozamomenetuv.pdfIn PDF document text
    • http://daselefufirapim.iblogger.org/wosebiw.pdfIn PDF document text
    • https://cdn.sqhk.co/ragojagef/gejeT87/77177519664.pdfIn PDF document text
    • https://cdn.sqhk.co/nedupugifuka/hgeyjaL/98746067849.pdfIn PDF document text
    • https://cdn.sqhk.co/wogefosa/k4iajer/celebrity_edge_cruise_ship_reviews.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/leributafa/46189169730.pdfIn PDF document text
    • https://s3.amazonaws.com/tifuwuw/almacigo_definicion.pdfIn PDF document text
    • https://238a82c5-85a8-4641-a991-2f0f5270ddc4.filesusr.com/ugd/63f22d_9a9a40c2e42249dbafd2c9be6c2465f1.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb91e1db-6477-46ae-bf8d-63f88b5b80df/12629032219.pdfIn PDF document text
    • https://s3.amazonaws.com/sevoga/spinal_stenosis_treatment_guidelines.pdfIn PDF document text
    • http://nupefurarinokol.rf.gd/rca_portable_dvd_player_drc6327e_manual.pdfIn PDF document text
    • https://c3e810f9-371e-40b9-9a0b-4695a496ec77.filesusr.com/ugd/2c7c49_25c10362563e468c9e914b311220fedc.pdf?index=trueIn PDF document text
    • http://xegeduv.rf.gd/63797715925.pdfIn PDF document text
    • http://dewonatazuji.epizy.com/class_character_sheets_5e.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxutedi/cannot_find_java_exe_ireport_solution.pdfIn PDF document text
    • https://s3.amazonaws.com/zerepuzuze/orissa_pin_code_directory.pdfIn PDF document text
    • https://s3.amazonaws.com/jebokizez/passion_translation_bible_free.pdfIn PDF document text
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_b46a0598250e4206bef794af1deb2ca0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcf9cb79-5db8-4533-b4e7-64b44529cc9c/vw_2.0_fsi_engine_code.pdfIn PDF document text
    • http://xogamix.rf.gd/69979708285.pdfIn PDF document text
    • https://s3.amazonaws.com/lepefi/99724062887.pdfIn PDF document text
    • https://s3.amazonaws.com/befarekogol/9938290762.pdfIn PDF document text
    • https://s3.amazonaws.com/sojebelevenex/22158728678.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFCE 5508 bytes
SHA-256: 37af354cd8a3bc845dd57e181fd63d89d7a212e5320efbb1ae6ecc37d219bdd0
font_01_sfnt_off00010266.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10266 11696 bytes
SHA-256: 75f6657228be15774319f8f15129a25d716d7c72aef48a4c74a0b76b6a2a859b

Open this report in the interactive analyzer, or submit your own file for analysis.