Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9f41b6a3496ed6e…

MALICIOUS

PDF

70.1 KB Created: 2021-03-17 08:49:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 3e2a1dcad06b435d1525c49789146f71 SHA-1: e91cb6b09a8effb161edee38679255b04df96b22 SHA-256: f9f41b6a3496ed6efe34956e39d4e2901ec15ea6885b02e8416a123ab6c86271
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs and is flagged as a link farm on disposable hosting, indicating a malicious intent to redirect users. The ML classifier and ClamAV detection further support its malicious nature. The document body, though heavily obfuscated, contains strings related to 'tripadvisor' and 'wkhtmltopdf', suggesting a potential lure or disguise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7558

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=honeyguide+khoka+moya+tripadvisor PDF link annotation
    • https://kexeretuzigu.weebly.com/uploads/1/3/1/6/131637303/mojer.pdfIn PDF document text
    • https://penarira.weebly.com/uploads/1/3/4/7/134742142/6491644.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412380/normal_5ffa98ec840f6.pdfIn PDF document text
    • http://bekokasutam.22web.org/79002367707.pdfIn PDF document text
    • https://puwaxitakobesod.weebly.com/uploads/1/3/4/1/134109073/dexubonisa_texisel_sularomawevat.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495391/normal_5ff2f0b1d6d3d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415322/normal_6017486416bb0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9ed8d2e-4926-4418-baac-fc99d7e42389/kugava.pdfIn PDF document text
    • https://599b09cd-7b6a-4758-94a3-08a08d316165.filesusr.com/ugd/628a76_ac20b73bc6784efc8fd5e97311761589.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/takebemanijewok/42986999185.pdfIn PDF document text
    • http://vopepogam.rf.gd/dobosewe.pdfIn PDF document text
    • http://muwalolerede.epizy.com/army_cadet_uniform_ironing.pdfIn PDF document text
    • https://9c789f27-b70c-4c9d-9e83-211ee8f99b38.filesusr.com/ugd/bdeb4c_c21a2dd93b2f4ae3a4166c05119dd634.pdf?index=trueIn PDF document text
    • https://67bb8873-ca08-4da4-87c0-60a8072ebff6.filesusr.com/ugd/a838c0_eb1b1ed7c0604e7d96f47c3b965773d0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8156fefa-404a-4aac-a674-469aa389f1ff/mofobizivegamapa.pdfIn PDF document text
    • https://c2267750-1f6d-4c2f-944a-eb302c7f07d7.filesusr.com/ugd/93971e_2bc97a4c50624206b4ff254223a60f93.pdf?index=trueIn PDF document text
    • https://0e9c393c-9feb-4465-ae9d-4486bea7a644.filesusr.com/ugd/4b68be_7fb6751ed31a4ea185290368347a94e9.pdf?index=trueIn PDF document text
    • http://fotopozivami.epizy.com/teks_qasidah_burdah.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/135818e6-d278-4538-8fa3-cd7a9f036a2e/is_bram_stokers_dracula_a_horror_movie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b46cd5c6-a809-47d7-98d2-c1d179caad81/how_to_create_new_paragraph_in_excel_cell_on_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/midizaxopazeji/master_the_art_of_storytelling.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27f410a4-fe1f-4ff4-85bb-f05a39ff4805/85009367897.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD26 5528 bytes
SHA-256: 5aa3f419dd967e76592c2a4a54bedf8dd368fcbcedbfe73426b9aa38814c7665
font_01_sfnt_off0000efd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFD3 10620 bytes
SHA-256: 008a4959331dcd0892d71de4ede148259e9f2083862a47bdb680c24ecc1d855e

Open this report in the interactive analyzer, or submit your own file for analysis.