Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5cf47c86a148d28…

MALICIOUS

PDF

81.0 KB Created: 2021-05-30 19:07:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 3d25afb34c603930c0a744a35c4b4e25 SHA-1: cf848952b0d5f126c699f2263ddbe8830d7d8d00 SHA-256: f5cf47c86a148d28ef05d340bb4eea1dc150cd86924b929b4b748decb60550f0
164 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=candy+crush+offline+pc+game PDF link annotation
    • https://vazanopika.weebly.com/uploads/1/3/4/8/134896022/nurifoxepozudasemiru.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386830/normal_5fdefa8da932d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388174/normal_606a60634efbf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390374/normal_604892aa258b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415742/normal_6058799f3f47e.pdfIn PDF document text
    • https://wopedibim.weebly.com/uploads/1/3/4/5/134585971/5625200.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402938/normal_602d438c1ff8a.pdfIn PDF document text
    • https://xukaxibuban.weebly.com/uploads/1/3/4/7/134701669/wamujunumumusaboma.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467561/normal_5fce493adf988.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446937/normal_60224174e2b95.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365612/normal_605bf387af52a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470687/normal_6038fa08973de.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490127/normal_5fca72c2428c9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b4315c5e-2742-43cb-bc76-96a36e95b17f/how_to_get_mp3_to_itunes_on_iphone_11.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc391ab6-bc7c-49f8-9628-fe151e5b1a44/ati_nursing_leadership_and_management_test_bank.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a01c9984-9e7e-4461-a950-147675fe5ed7/volume_of_a_cone_worksheet_8th_grade_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5526612a-2913-447d-8e55-8cd81a9e39a8/national_electrical_code_nec_handbook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/faef4b1e-889b-4c69-953b-c488105e6ef7/best_way_to_study_romeo_and_juliet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1963d7e4-10c7-4ab6-8f2a-f965dae1b720/bleach_vs_naruto_mugen_apk_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a14ebc99-f7cb-4463-a675-0583bdf88646/transformar_6_pulgadas_a_mm.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f018.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF018 5496 bytes
SHA-256: c1686a7307dbabe32c2ac99cbe68673189c5df26a6930d599130295efd7c5d76
font_01_sfnt_off0001029f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1029F 11028 bytes
SHA-256: b0f0877f2448da34bf298a756adb164ea8643215106734e2e3b95a23a483e037
font_02_sfnt_off0001283c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1283C 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.