Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea4d42ca10220303…

MALICIOUS

PDF

89.2 KB Created: 2021-05-29 21:43:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: a32fe39282257c355d347b787fcda339 SHA-1: 168f72bab879bb97ef8e9f52adff7368cb3f4228 SHA-256: ea4d42ca102203033570bb12500bf49b573e962ba8a313e4fae44eacb8fabed5
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a significant number of external links, flagged as a 'PDF_SEO_LINK_FARM', suggesting a malicious intent to manipulate search engine results or redirect users to potentially harmful sites. The ClamAV detection and ML classifier strongly indicate maliciousness, classifying it as a phishing trojan. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the link farm heuristic point towards a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=cambridge+pet+practice+tests+pdf PDF link annotation
    • https://xatosupitoso.weebly.com/uploads/1/3/4/0/134018334/9354148.pdfIn PDF document text
    • https://giderolimarova.weebly.com/uploads/1/3/4/0/134098849/bapokin.pdfIn PDF document text
    • https://wimupivirexov.weebly.com/uploads/1/3/4/9/134901171/8148489.pdfIn PDF document text
    • https://xopigitit.weebly.com/uploads/1/3/4/3/134339451/7951478.pdfIn PDF document text
    • https://xetibipu.weebly.com/uploads/1/3/4/5/134528590/fatajibeziwidipez.pdfIn PDF document text
    • https://xazalonabi.weebly.com/uploads/1/3/6/0/136086847/7335819.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/86571229-89b0-4c07-a78c-67105af44133/how_to_oil_filled_heaters_work.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d4c0a53-2c6c-4c39-b476-f6320d6f1c9c/76044250768.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/348906bf-b3f2-467f-9019-cb957de1c8db/what_are_the_top_penny_stocks_to_buy_now.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0cff31ad-0f6f-4492-a85a-e2a94fe40ca6/xefixiposamimot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27930ba7-08ef-4067-b8b8-8c82db46cdf3/first_aid_usmle_step_1_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5328ef98-e012-47a9-8568-2574a8a775f8/nonorevuwevodutizo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6cf0130d-a04d-43e5-aa1e-df00652ac458/sony_rm-vl600t_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21ef6bad-e4ea-436c-8168-489ee6acc7c9/96852361432.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87374bf1-5af6-435b-8c4b-fe1f6458a04f/96303759782.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5a509d2-a823-4047-9a7d-5514b4a950af/2021_ranger_bass_boat_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e03fc5ae-9e28-4eb2-acac-d05b75163d77/howls_moving_castle_theme_piano_chords.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c93c9fa4-ea1d-4276-af51-559499d3845e/is_65_polyester_35_cotton_soft.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96d32569-7a09-4d81-a40e-9279c92d6d43/fobofuwu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2631e736-2f81-4d44-afcb-aa3e477c4172/30296340520.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7be30823-8857-41b3-a1ea-4a6a26713076/can_you_cook_a_whole_turkey_in_an_air_fryer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8052743-4143-4686-962a-9b7842cdc342/usps_form_3602-n1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e802f38b-4c80-4251-8449-82f2cb3e474b/43851242543.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a163221-006f-42a1-8c17-43035f5beabe/what_does_a_food_service_manager_do.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c10dfeb2-776e-4fe4-ae30-53da2725b44b/what_can_cause_a_dryer_to_not_turn_on.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbdff38c-5701-4547-99dd-8da64e57a41c/history_of_the_world_in_100_objects_book.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2AF 5488 bytes
SHA-256: 3eb8a3899272c9d78d8b84075b9e249f9b7ae04ee1d2087bcc03ae8852e0fb6f
font_01_sfnt_off0001052f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1052F 5396 bytes
SHA-256: 530c1365ef46850e0d7b4a52da6588e50e4f4215e729ddeaa32dc5b44b8479f8
font_02_sfnt_off000118bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118BF 11604 bytes
SHA-256: 00aebb10c3a59ba121113459046a7ef97bbfb94f72c3ac9088438a0f8526bfaf
font_03_sfnt_off00013eec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13EEC 16312 bytes
SHA-256: 975089639afea594160f6daa1ae948ffc4125994d61a9fd32dce02580f7b6b15

Open this report in the interactive analyzer, or submit your own file for analysis.