Malicious PDF — malware analysis report

Static analysis result for SHA-256 f770167549572cd8…

MALICIOUS

PDF

74.3 KB Created: 2021-04-01 04:50:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 97790f6cb3c8acd9c74d86a3bfd8aaa0 SHA-1: 508085d54f45deb93ae42907ee0c6db6fa6be1ca SHA-256: f770167549572cd8a77de5badcb18a8fba49a6b50d52b5fcc4020a5812f52f3d
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=phonics+sounds+flashcards+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4376850/normal_5fd67080b2ccd.pdfIn PDF document text
    • https://luvidobanuneje.weebly.com/uploads/1/3/1/6/131606009/xaxeribifujo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451556/normal_6047464fa19a9.pdfIn PDF document text
    • https://dexasarejujevi.weebly.com/uploads/1/3/1/4/131454537/nemovukemivabun_veludoxi_betiku_dizuwitofuvus.pdfIn PDF document text
    • https://lanulizuxuja.weebly.com/uploads/1/3/4/6/134658029/ratasofo.pdfIn PDF document text
    • https://zugozoriv.weebly.com/uploads/1/3/4/7/134770463/zominezizud.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450418/normal_5fcf827d59df8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/towutoginadivu/short_adventure_stories_in_english_for_class_6.pdfIn PDF document text
    • https://s3.amazonaws.com/gixirojozogufux/how_much_does_it_cost_to_get_a_garbage_disposals.pdfIn PDF document text
    • https://2225f16e-b6a0-48e2-a067-d7e802b71dd4.filesusr.com/ugd/a7ada4_433b9e6b9ac84d35af290ebcbc5d9352.pdf?index=trueIn PDF document text
    • https://b4140449-9b96-4148-8619-c9b3eed7b48c.filesusr.com/ugd/c33cdb_77e6e51f5f2c4a0f8c4f77cdf698eb81.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/defujo/stoopid_buddy_stoodios_animation_camp.pdfIn PDF document text
    • https://dc010c70-835d-4b56-8cb0-1e1bda7cab64.filesusr.com/ugd/fb576b_c4675f4054324ab7a51c515e139ee057.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gixawetopoli/does_netflix_have_one_punch_man_season_2.pdfIn PDF document text
    • https://s3.amazonaws.com/setigafat/rojevatogun.pdfIn PDF document text
    • https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_723c89aeac81419ab02212bef80dd533.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bejokazemur/34495154097.pdfIn PDF document text
    • https://s3.amazonaws.com/lopadivupudexa/68396149640.pdfIn PDF document text
    • https://s3.amazonaws.com/dorobukasawituw/bugs_and_insects_preschool_worksheets.pdfIn PDF document text
    • https://299bc67c-4c9a-44ea-852c-18f2d39dca40.filesusr.com/ugd/954c8b_c3275b85ebe845569febaa196c701cc7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/baxunaf/play_store_pending_but_not_ing.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3C5 5244 bytes
SHA-256: 165051c1adb36b827ae8cd75ec65a1b710255ab281a6eef980572eb937588975
font_01_sfnt_off0000f597.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF597 11740 bytes
SHA-256: 844cd5fe5ada0237f50748daf96f20f1af00c425616e33d91cf1c3e1b5b7bcfa

Open this report in the interactive analyzer, or submit your own file for analysis.