Malicious PDF — malware analysis report

Static analysis result for SHA-256 f60b7e84d4b9af01…

MALICIOUS

PDF

113.2 KB Created: 2021-03-11 03:21:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 36bf27ae85e26bcd01148c219b865767 SHA-1: 3646556a9a8693c2f63fbc2006de7c95f207164a SHA-256: f60b7e84d4b9af014b9242a56ec89baa4dd9051106cf342ad1161badd6abeb0a
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9625

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=reglas+del+basquetbol+pdf PDF link annotation
    • https://kikizesojumare.weebly.com/uploads/1/3/4/7/134718780/113b31b.pdfIn PDF document text
    • https://xoxoxiwozolem.weebly.com/uploads/1/3/0/7/130739626/b151dbbda6a5.pdfIn PDF document text
    • https://jerepukiw.weebly.com/uploads/1/3/2/6/132681878/sejino_gavavazoko.pdfIn PDF document text
    • http://noluwokufemifoz.22web.org/is_there_going_to_be_a_season_2_of_abyss.pdfIn PDF document text
    • http://zatoxuvisovapuf.sportsontheweb.net/nissan_50_forklift_specifications.pdfIn PDF document text
    • http://xeresorejal.iblogger.org/who_does_maxon_marry_in_the_selection.pdfIn PDF document text
    • https://futinubub.weebly.com/uploads/1/3/5/3/135328842/25294214331f.pdfIn PDF document text
    • http://nuvifufaronez.22web.org/13993339114.pdfIn PDF document text
    • http://baxagaxisatipa.22web.org/8173742508.pdfIn PDF document text
    • https://rerararomimin.weebly.com/uploads/1/3/1/3/131383042/sebogibi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jujadodedaruxix/ahad_nama_arabic.pdfIn PDF document text
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_42828205b08a40b592fdfa7d05e44c36.pdf?index=trueIn PDF document text
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_b17fba9a5d644998b74210e8643ac448.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/55244344980.pdfIn PDF document text
    • http://bikutuvuxaxixo.epizy.com/39774077521.pdfIn PDF document text
    • http://dorowoz.rf.gd/polotadubujub.pdfIn PDF document text
    • http://sabepusejoponi.epizy.com/23447830783.pdfIn PDF document text
    • https://c1d61d78-9bae-425c-b347-ee91470fe4f1.filesusr.com/ugd/60933b_1ae60ba3f34b49e5b60398e04e6caa3b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gavexilatuvitaz/paxirobopapakabowi.pdfIn PDF document text
    • http://gakajitaju.atwebpages.com/51914274025.pdfIn PDF document text
    • https://s3.amazonaws.com/zesotat/canon_sx700_hs_manual.pdfIn PDF document text
    • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_caddbdd0d7344337a454ce2f81d249a9.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a3af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A3AF 5384 bytes
SHA-256: 6e1d4574ea128e8dffc039f09c6a06525446b755c864927061e17f6c3d2c2290

Open this report in the interactive analyzer, or submit your own file for analysis.