Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa7c38145932f33c…

MALICIOUS

PDF

76.4 KB Created: 2021-04-22 02:23:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: e5d2d6b1f82fc519b76133275d21734d SHA-1: 5b6fa4338889f52527608f089eaba06ab1e38c86 SHA-256: fa7c38145932f33cc45f531fc331aade508a51636f746b29367efd1e00ee25fd
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=les+pronoms+relatifs+qui+que+o%25C3%25B9+exercices+pdf PDF link annotation
    • http://toworugesolur.getenjoyment.net/radio_shack_weather_alert_police_scanner.pdfIn PDF document text
    • http://ceter.xyz/rusegimabanejc9fbj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449774/normal_6047519b6557c.pdfIn PDF document text
    • http://mujoxoluvisukid.getenjoyment.net/doro_flip_phone_battery_replacement.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469849/normal_6033943ad8ac6.pdfIn PDF document text
    • http://bestcreditcheck.info/the_rational_male_positive_masculinity_by_rollo_tomassixv43h.pdfIn PDF document text
    • http://zukirudon.mypressonline.com/how_to_cope_with_bpd_mother.pdfIn PDF document text
    • http://didibemez.scienceontheweb.net/rechargeable_battery_types.pdfIn PDF document text
    • http://zajilakofudo.scienceontheweb.net/38948578829.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365653/normal_5fca83e7d1025.pdfIn PDF document text
    • http://tesar-krd.ru/learn_how_to_draw_anime_for_beginnersyut3q.pdfIn PDF document text
    • http://lajafago.medianewsonline.com/28968492689.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/4d4f362a-3f13-44ae-9d69-afd9b99376b9/army_reserve_drill_weekend_schedule.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/525d4630-dc00-47ea-8cd5-46a124a1c61f/47866466447.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f37ac059-8e92-4d5c-8f60-816e746a5317/98362845238.pdfIn PDF document text
    • http://mukanebesiva.atwebpages.com/62845296673.pdfIn PDF document text
    • http://pozidijapepore.atwebpages.com/74804510593.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/988338f7-be0f-44e2-8173-117f6dc68143/yard_machine_snowblower_not_starting.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/113594e4-3e4f-47dc-aa8e-2ff0ec8242d2/suzafukapafamol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46d37ccb-3f59-4b59-a565-bb7725bbb06e/how_to_colour_still_life_drawing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e6bef2d-cd77-4abb-9c28-e0ad96e9eb20/35317271842.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d956.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD956 5432 bytes
SHA-256: 539a433fca4ceed772b99f758f0f18683f52b1ed9641ed38316668716b2e45c0
font_01_sfnt_off0000eb83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB83 12860 bytes
SHA-256: 53e36690ca1742fa370f51e672c3eeb4a75b94ccfbbbfe285973f3781096b133
font_02_sfnt_off000113e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113E3 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.