Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7873b07b6ba2066…

MALICIOUS

PDF

72.2 KB Created: 2021-03-28 11:02:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 5dce34401444d9030ad4ac8c32fb7811 SHA-1: b612f08566fc1b6d6f6c14662d30526ac8d66796 SHA-256: e7873b07b6ba20660b8dd1626af8d84d46c7caced36a81a4b14e7c1df0dd353f
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9725

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=zimerman+guite+i+velhice+aspectos+biopsicossociais+pdf PDF link annotation
    • https://cdn.sqhk.co/givogaduta/2igLjhZ/torifefepoxefikuluvirorap.pdfIn PDF document text
    • https://cdn.sqhk.co/mexovaru/ByGMRig/the_battle_cats_hack_apk.pdfIn PDF document text
    • http://trackcreditscore.info/rmv_learners_permit_test_practicemu22g.pdfIn PDF document text
    • http://digitalcalakk1.xyz/how_to_find_the_missing_measure_of_a_trapezoidap4bv.pdfIn PDF document text
    • https://cdn.sqhk.co/xufatirumina/gegirie/30537895722.pdfIn PDF document text
    • http://copyrightproblem.com/bean_bag_toss_distanceb146v.pdfIn PDF document text
    • http://adanakebap.org/lonepopipaxabi5pmos.pdfIn PDF document text
    • http://casser.xyz/89233593329y6kd8.pdfIn PDF document text
    • https://cdn.sqhk.co/pavujakorige/pmCwwhb/santorini_greece_hotels_with_private_pool_in_room.pdfIn PDF document text
    • https://cdn.sqhk.co/vavusiwi/k9hija1/bass_pro_shop_black_friday_sale_2019_ad.pdfIn PDF document text
    • https://cdn.sqhk.co/zenegiwowi/gehePQl/vabizamesasepizim.pdfIn PDF document text
    • http://like-store.site/52548266228modq9.pdfIn PDF document text
    • https://cdn.sqhk.co/bobimugura/PKWsqge/paint_frog_eyes.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f3b86e06-b3aa-4ee1-82f7-79049f3379a8.filesusr.com/ugd/0c4fd2_f6af74850ec54a87b470f77ce16ff2fb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/business_management_certificate_online_canada.pdfIn PDF document text
    • https://d7d9470a-9784-4c28-ac68-b1ab0f70ddf3.filesusr.com/ugd/148484_3524b3d207f74c9ba8163af667d7fe54.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gizonukorad/43647765760.pdfIn PDF document text
    • https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_6b7118b3f60a4dfa9294a3622978840f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rizijubovapuk/best_youtube_channel_to_learn_python_in_hindi.pdfIn PDF document text
    • https://c3373aeb-ed74-4f2d-b631-fa679e0a3f6f.filesusr.com/ugd/cbe7f7_391473302bb04e43bc241705ff3a2277.pdf?index=trueIn PDF document text
    • https://66f9544f-8325-470d-a543-c07714603334.filesusr.com/ugd/4b2642_a913515f43bc46d69be929df40bd8095.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xufoxorog/dolemosifuxibipuzoduru.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/beck_s_depression_inventory_score_sheet.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9D8 5724 bytes
SHA-256: a21129bef1cb5cfafbe0fb286f8b23de8937f07d39a00fd75db5fd5baaf9b6d1
font_01_sfnt_off0000fd2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD2D 13440 bytes
SHA-256: c03dce4712dfac29914bda21c32595916ed9416422e35bf63ba9826c690a2bb0

Open this report in the interactive analyzer, or submit your own file for analysis.