Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecc6dde531686387…

MALICIOUS

PDF

73.5 KB Created: 2021-05-18 18:30:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: caf5c070846b7ec3db4fa3f5f020d314 SHA-1: a16da58553cc5e8522ed36524b5cdc4800273609 SHA-256: ecc6dde5316863873805cd0dc7349ab062974bb2cf4c3c11f1f87065449ea603
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=yeralti+canavari+1+t%25C3%25BCrk%25C3%25A7e+dublaj+full+film+hd+izle PDF link annotation
    • http://sojuvofud.22web.org/minuet_in_g_bach_piano.pdfIn PDF document text
    • http://vukuwupevipe.iblogger.org/mac_pages_brochure_templates.pdfIn PDF document text
    • http://sovozuzujujike.22web.org/17183892879.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/f7b58a5f-da3e-4074-a4d0-b367f8734ecd/36726326322.pdfIn PDF document text
    • http://tujijekaxevon.rf.gd/30591481723.pdfIn PDF document text
    • https://s3.amazonaws.com/minabiwa/adventure_time_minecraft_mod.pdfIn PDF document text
    • http://ravigokabuf.rf.gd/follow_us_on_social_media_email_template.pdfIn PDF document text
    • http://negatesuxa.epizy.com/after_2_ita_libro.pdfIn PDF document text
    • http://wipidomi.rf.gd/61909415852.pdfIn PDF document text
    • http://bunebuka.rf.gd/gujotesaritimukudegud.pdfIn PDF document text
    • https://s3.amazonaws.com/zifozujiwi/what_happens_when_you_burn_real_gold.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1de72ff0-9a0e-4b9e-947d-c20e56a02d2d/how_to_learn_plc_programming_free.pdfIn PDF document text
    • http://sipikoz.epizy.com/kigulojotofufiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d56497a3-29d9-4f7b-a2c6-e4160aebb1f8/vesanemurir.pdfIn PDF document text
    • http://zapavuvezozetet.epizy.com/photive_ph-bth3_bluetooth_headphones.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d83d6c16-4c49-426a-8ecb-7fdae636a4bf/bible_reading_plan_90_days.pdfIn PDF document text
    • http://zigimavabixexib.epizy.com/subbarao_ethics_book_download.pdfIn PDF document text
    • http://poniweja.rf.gd/decode_base64_to_file_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5384f33-221b-4661-83c6-87c56abddf68/what_is_literature_review_in_research_paper.pdfIn PDF document text
    • https://s3.amazonaws.com/gezizefefififa/nortel_m3904_charcoal_ntmn34ga70_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d184.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD184 5560 bytes
SHA-256: 602cc920e4a67fd887a663855d97de7fa90c88d26b3b93b5862c30c56993ca8f
font_01_sfnt_off0000e3d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D2 11488 bytes
SHA-256: 273780343e2c1baca23a8b43ef52321032e301cae64100039e24cd01c39b9d23
font_02_sfnt_off000107e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107E1 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.