Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd94dc470cdc1034…

MALICIOUS

PDF

82.5 KB Created: 2021-04-27 10:50:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 7b9a0cb8ac6627d5a1a007da57acf418 SHA-1: 13de49d284908b62c4f92adca7c62c0d1d145cc2 SHA-256: fd94dc470cdc10346e17f67f3fde42d3426d1ef7e420e9d652a7a9e040a6a1b2
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=the+naturals+series+book+6 PDF link annotation
    • http://kalowodopole.mygamesonline.org/29864248045.pdfIn PDF document text
    • https://cdn.sqhk.co/gedofovel/bn3hrij/origami_star_paper_strips_michaels.pdfIn PDF document text
    • https://cdn.sqhk.co/karapenakozi/hFVgjkq/kevawonokalo.pdfIn PDF document text
    • https://cdn.sqhk.co/bulenupulabo/hefSvhW/kung_fu_cat_tiktok.pdfIn PDF document text
    • http://jopagozopive.medianewsonline.com/azeotropic_distillation.pdfIn PDF document text
    • http://puxeguka.iblogger.org/calendar_worksheets_year_1.pdfIn PDF document text
    • https://cdn.sqhk.co/toridezoxiko/j4Yid0Q/roblox_download_chromebook_os.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/3eb3b02a-a3ee-4379-b782-8219f3e9d021/equivalencia_de_kilogramos_a_gramos.pdfIn PDF document text
    • http://jovurafop.epizy.com/lowuwatunu.pdfIn PDF document text
    • http://ketabigumowun.atwebpages.com/last_of_the_mohicans_music_promontory.pdfIn PDF document text
    • https://e46eb8ae-11b5-47af-91b5-79e2db369635.filesusr.com/ugd/f84671_fb4180e042ca488ba474ea93dc9deeed.pdf?index=trueIn PDF document text
    • https://e25b5f36-ee09-4010-8803-019b2853a23b.filesusr.com/ugd/c34eac_7bb9ee6853c5460184b1396f8689803f.pdf?index=trueIn PDF document text
    • http://xarilupinedup.myartsonline.com/achyutam_keshavam_lyrics_in_english.pdfIn PDF document text
    • https://c245485c-e1a4-4c5a-9a2a-c465a95e53c8.filesusr.com/ugd/25f824_a5309ff8197c4c80b159262c58d4d0de.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/21118173-4e14-4cc6-a285-b94450239872/bose_mini_speaker_connected_but_no_sound.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8193966-aaea-46f3-b6e8-172881919c65/dinogerozis.pdfIn PDF document text
    • https://fac30f9c-1bc3-4ff6-ac40-7ced1d2a170b.filesusr.com/ugd/3b7182_579063b0b42042b8b35327bc18ec6d6e.pdf?index=trueIn PDF document text
    • http://voxuluvaj.epizy.com/90660092123.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5db7c08-154b-46bd-8a18-a25f89e09d08/how_to_cook_corned_beef_on_slow_cooker.pdfIn PDF document text
    • https://034618a9-9b39-4f41-ad18-95bca1d1c80b.filesusr.com/ugd/48d9a1_4d48958a2df74c4a8a3f71c5193b2c82.pdf?index=trueIn PDF document text
    • http://xuwiviw.rf.gd/carnitina_scielo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f651.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF651 4960 bytes
SHA-256: 7bf21b60e56683a6c7de418cd457cd878fc6cf04f69d95522400207053e6cb2c
font_01_sfnt_off0001071a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1071A 11192 bytes
SHA-256: 6712eb86c4d948f7e3780d4290ee019d1c7a057c587f3e7844572ef52e72084b
font_02_sfnt_off00012cf5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CF5 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.