Malicious PDF — malware analysis report

Static analysis result for SHA-256 e78e2d00749bf178…

MALICIOUS

PDF

69.4 KB Created: 2021-05-31 17:56:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: abd31e37859d5ac0f02a17dad8a28992 SHA-1: be565bb8a0fd03068d4fa15d02a441d4b4aa4cc2 SHA-256: e78e2d00749bf178fa11ec5cb38860c0adc9d583d47ecd6f5363369fd46edeaf
184 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=gre+physics+practice+test+with+solutions+pdf PDF link annotation
    • https://bipixexomalexu.weebly.com/uploads/1/3/4/3/134349320/lenimunowukigaje.pdfIn PDF document text
    • https://gunarolapikomi.weebly.com/uploads/1/3/4/4/134442839/fae5b373cdce6.pdfIn PDF document text
    • https://wurilulisewanid.weebly.com/uploads/1/3/4/7/134728532/pugorip-xaxemiwoxibos.pdfIn PDF document text
    • https://zarujiwimil.weebly.com/uploads/1/3/4/9/134900424/7216308.pdfIn PDF document text
    • https://jozurukezareta.weebly.com/uploads/1/3/4/7/134741488/64cdea9.pdfIn PDF document text
    • https://judexibegajojid.weebly.com/uploads/1/3/4/8/134885636/juxozo.pdfIn PDF document text
    • https://livozowenenebu.weebly.com/uploads/1/3/0/8/130874097/nupigekerimewafi.pdfIn PDF document text
    • https://xagigerabep.weebly.com/uploads/1/3/1/4/131483632/1740771.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e10cf462-a863-4102-b4b6-920785badedf/4250889992.pdfIn PDF document text
    • http://pezeliv.pbworks.com/f/58674844462.pdfIn PDF document text
    • http://lekuzax.pbworks.com/w/file/fetch/144412215/adobe_photoshop_classroom_in_a_book_2021_release_download.pdfIn PDF document text
    • http://funinupun.pbworks.com/f/tofejusirexoleguba.pdfIn PDF document text
    • http://dekokos.pbworks.com/f/13610793161.pdfIn PDF document text
    • http://sizolasipape.pbworks.com/w/file/fetch/144411414/palabras_agudas_llanas_esdrujulas_ejemplos.pdfIn PDF document text
    • http://lakebimutep.pbworks.com/f/ikea_luroy_full_bed_frame_instructions.pdfIn PDF document text
    • http://zopujoxobug.pbworks.com/f/22610327837.pdfIn PDF document text
    • http://kufujibumufa.pbworks.com/w/file/fetch/144411858/troy_bilt_5500_watt_generator_troubleshooting.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ee8a969-e775-4ca2-abb1-bd42637dcf6a/55030369240.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e112.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE112 5468 bytes
SHA-256: bf247abb1a7e1f0c6eb4107f7e1188dbb3a0a3166ff227501e3fa43696f89ac2
font_01_sfnt_off0000f3c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3C3 10416 bytes
SHA-256: df52b03f565afffe63b5a95ec681d7804b1cc1d042db7c99ca988a6d9b9988d0

Open this report in the interactive analyzer, or submit your own file for analysis.