Malicious PDF — malware analysis report

Static analysis result for SHA-256 f541da1876be5d51…

MALICIOUS

PDF

71.6 KB Created: 2021-03-19 05:00:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 447467fa6f5ef9db8c36068939742bb6 SHA-1: 6f00b183869ba6c1a881ae59f8e73a988aba71f7 SHA-256: f541da1876be5d51e50e0135574b942466a2a5d28ce33de06861fd120540f603
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9524

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/aws?utm_term=can+you+sue+for+abuse+of+power PDF link annotation
    • http://zoxodur.sportsontheweb.net/how_to_calculate_the_unit_product_cost.pdfIn PDF document text
    • https://zoponexe.weebly.com/uploads/1/3/1/6/131606878/lodoraxijoj.pdfIn PDF document text
    • http://jotitojimo.mygamesonline.org/can_you_use_a_ps4_controller_on_xbox_one_without_cronusmax.pdfIn PDF document text
    • https://gubojipupulep.weebly.com/uploads/1/3/4/3/134359502/sosebilerigogawe.pdfIn PDF document text
    • http://pasikufopubiwo.mypressonline.com/63621595070.pdfIn PDF document text
    • https://muwirejevom.weebly.com/uploads/1/3/1/8/131857435/latudutejo_vexozevavumote.pdfIn PDF document text
    • https://wupifikuzokure.weebly.com/uploads/1/3/4/5/134529023/3582267.pdfIn PDF document text
    • http://xomofaki.getenjoyment.net/55748290221.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417834/normal_5fcd3cf169223.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452609/normal_5fe238b26ba01.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99253363-36b0-44d2-8fd4-f5379682c621/dura_ace_di2_disc_groupset_with_power_meter.pdfIn PDF document text
    • https://1b53f64c-3596-40ff-86ea-95cec8902569.filesusr.com/ugd/838e7e_75d27b11e5824ab58686d1ee4857ccac.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd090e10-100c-4660-b4de-40db28516ab6/newtons_3_laws_of_motion_meaning.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba810500-d812-4e6e-aca1-201229fc8992/mcdonalds_marketing_mix_process.pdfIn PDF document text
    • https://a7176590-a44a-43b4-8b25-1171fb6190ac.filesusr.com/ugd/e6ccb8_29792ada202e4a9cbd7b65ba3ed7d1c5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c62dfc0-4eec-46c2-9a2f-a6649e4d345a/lupevufifilunaku.pdfIn PDF document text
    • https://cb2d4818-2134-4ea5-ae57-1bc45cfc4292.filesusr.com/ugd/7e787c_a660099034154b0994ec43ed0632bf82.pdf?index=trueIn PDF document text
    • https://9d50af6f-dbf7-41ba-b854-83985329a12b.filesusr.com/ugd/33c377_81246c062f2f4d22adac302cbea8ff58.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/62b7c171-ad8e-464c-829a-8d01d0ed2b97/6320807897.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ffa480f-9630-4997-9d0d-0ee4427bf97c/22188248405.pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000fb34.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xFB34 11601 bytes
SHA-256: 510ed4246a97ec610c088377a53f7952f54c182d6df57f1a09df2fbcd9fa6794

Open this report in the interactive analyzer, or submit your own file for analysis.