Malicious PDF — malware analysis report

Static analysis result for SHA-256 f433ca1f15a38bbe…

MALICIOUS

PDF

76.3 KB Created: 2021-03-09 20:55:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 7e28a37d6bd0eec870a1fdceb54a7bec SHA-1: 298a4ffb31b25c80caad539a899572f074e4f534 SHA-256: f433ca1f15a38bbe56b082581789e1d80b800a8e2df52033b6c71535009b61c6
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9477

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=centrifugal+pump+velocity+triangle+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481667/normal_602ffbb3a737c.pdfIn PDF document text
    • http://characduwe.space/masons_rule_examples6a79u.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412377/normal_5fdbe518cbb13.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451035/normal_6041bac8762b7.pdfIn PDF document text
    • http://noverst.xyz/9892471171cunkf.pdfIn PDF document text
    • http://yogait.space/kumukutikutitap_music_sheet_satbr3gss.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://147762ec-90f0-4523-8579-43cb3cd17c82.filesusr.com/ugd/6c48b9_572b18e868f84bfaa1326c3499156890.pdf?index=trueIn PDF document text
    • https://28ed73df-463f-41d7-bc87-4635118fd8e0.filesusr.com/ugd/74acc8_fdaac7878bd442ad97fe21a0b17c9953.pdf?index=trueIn PDF document text
    • https://ececae0b-1312-4a4c-959a-117928b3d478.filesusr.com/ugd/e6721e_513ed6a9002642d2bc3d7a53481a56d6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5069c0e7-de9d-44fc-a363-1ac0c7604d31/ryobi_electric_chainsaw_stopped_working.pdfIn PDF document text
    • https://e29a9437-b0a5-48a6-9afa-908397ce514a.filesusr.com/ugd/16a9c1_5f45e97bbdcc4880b1e33d9424d2de0f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cff12c70-6bea-4359-a2b2-2dfbbacf2581/how_to_replace_oven_light_kitchenaid.pdfIn PDF document text
    • https://1afae0f6-9e35-4dc9-9db7-5dbf78511926.filesusr.com/ugd/afe78f_ed2335fd21214afb87cabe018172f40a.pdf?index=trueIn PDF document text
    • https://661c91a2-68a2-4ae3-aaac-ef96b6cc7894.filesusr.com/ugd/b926a8_1344f340338347019821228098c85d10.pdf?index=trueIn PDF document text
    • https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_59a08b93b48844bbabdf692bbca00d37.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c758ed5-663d-40bf-9e90-02baf1bb6523/23239719829.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9F2 4148 bytes
SHA-256: 292e4d2d40fabbb686a3ecb4a83b374893d48e6d28f2624159ccf15231c94663
font_01_sfnt_off0000e889.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE889 5364 bytes
SHA-256: 562979b86aedc04ac58a329415579f065cf784112df48510b8b7cf2fe48f1491
font_02_sfnt_off0000fabe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFABE 10516 bytes
SHA-256: 53e9968c1853c2a2e89c1ac7e4e8616f78f37b6d8ac92a1dc4f6c93ab5d67766
font_03_sfnt_off00011eb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EB8 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.