Malicious PDF — malware analysis report

Static analysis result for SHA-256 e77396424156851c…

MALICIOUS

PDF

65.1 KB Created: 2021-06-09 21:58:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 222596e3cb14fde6e1ad3e4c2e08c935 SHA-1: 8b8d57599184f6ca778e1e17416831464153e6bf SHA-256: e77396424156851c9c257f0bac1548b19b4e5e6715cba48283b0197d7765af4a
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/pbw?utm_term=money+receipt+format+for+sale+of+flat PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4382412/normal_604adc250352e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381105/normal_603155d930ced.pdfIn PDF document text
    • https://niboxevukok.weebly.com/uploads/1/3/4/6/134649508/pegupakodoxuruj-fefunejori-xabax.pdfIn PDF document text
    • https://wipiwabe.weebly.com/uploads/1/3/4/4/134438476/kejeloxafa.pdfIn PDF document text
    • https://vunisanelebori.weebly.com/uploads/1/3/3/9/133999195/39452de7f4290.pdfIn PDF document text
    • https://kolojadulosa.weebly.com/uploads/1/3/1/3/131397946/7666994.pdfIn PDF document text
    • https://jeraligasusuwaj.weebly.com/uploads/1/3/4/5/134528446/mojof_mamajuvowu_watitakopelivi.pdfIn PDF document text
    • https://tipirigemiwar.weebly.com/uploads/1/3/4/0/134016889/vopijubawu_reseka_waxumeluf_zifapo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418401/normal_6014c99693c8c.pdfIn PDF document text
    • https://tekazomegi.weebly.com/uploads/1/3/4/0/134017279/venulapokugilen_pufimunopi_gorametixuw.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb088732-b53b-46a9-963c-2274f7d470bd/56976269702.pdfIn PDF document text
    • http://matajin.pbworks.com/w/file/fetch/144709869/how_to_find_spotify_premium_code.pdfIn PDF document text
    • http://vesusezipuwe.pbworks.com/f/sitida.pdfIn PDF document text
    • http://visetululiv.pbworks.com/w/file/fetch/144421497/la_ltima_oportunidad_carlos_cuauhtmoc_snchez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8f82f51-beee-4a56-8c9e-d1770d956c4e/gepuwazijesusenaborapi.pdfIn PDF document text
    • http://kiletejude.pbworks.com/w/file/fetch/144894174/kuxokekipagiluperu.pdfIn PDF document text
    • http://mapijakemifo.pbworks.com/f/hematologia_e_bioquimica_veterinaria.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1802d0d3-a001-4983-9e5c-542269d9230c/lojexifuluwesuxofu.pdfIn PDF document text
    • http://tukufidanega.pbworks.com/f/vojarodavo.pdfIn PDF document text
    • http://gifavipa.pbworks.com/f/skills_practice_similar_triangles_answer_key.pdfIn PDF document text
    • http://rivikixizub.pbworks.com/w/file/fetch/144873948/xetat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c30a2179-cdfd-47df-96d2-654b18b6883f/80801084319.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f475.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF475 5268 bytes
SHA-256: e17ef119bb784006019112da2dfb7fb56405b38d9628cd4ac07affd3276efa8f

Open this report in the interactive analyzer, or submit your own file for analysis.