Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdc11f4036b3512f…

MALICIOUS

PDF

96.4 KB Created: 2021-05-24 03:12:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: c360d021c72f22d84cd7e9c50c8008d2 SHA-1: 2277124bd2afcff1d8e6690b0baed0ad2ccdadf4 SHA-256: fdc11f4036b3512f2e01eb7a3d3ab86a15a028f12c4e19fdfce1e184f92ed677
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which point to SEO-optimized content farms and redirectors, such as 'https://fokemale.ru/strik?utm_term=why+did+islam+spread+so+quickly+dbq+answer+key'. This behavior, combined with ClamAV and ML detections, strongly suggests a phishing or malware distribution attempt disguised as an academic resource. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=why+did+islam+spread+so+quickly+dbq+answer+key PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368240/normal_6016941e97c22.pdfIn PDF document text
    • https://ranadapibefa.weebly.com/uploads/1/3/0/8/130874213/621618.pdfIn PDF document text
    • https://getaforufuzok.weebly.com/uploads/1/3/4/7/134733873/tisafasigoze.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450354/normal_60405391c9adb.pdfIn PDF document text
    • https://nabesoke.weebly.com/uploads/1/3/4/0/134042749/c5c511bc156176e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420924/normal_60480821ad841.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387817/normal_606b869e2562e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/38804a0c-8f87-42e3-882f-7eb6ecc683b4/nabamotitezalegik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44740160-8501-4a21-ae57-e112f9f976d4/ragatoxaxurudakewobivaren.pdfIn PDF document text
    • https://s3.amazonaws.com/tozaduliwubega/tojufetudalupusizudixafu.pdfIn PDF document text
    • https://s3.amazonaws.com/viromibukoleliw/kovegamigakifewupele.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff2add48-b643-4e60-9eb4-6f933a4b5fc2/28525099393.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ef8468f-b122-4445-8aee-e773a7004f1b/what_type_of_bobbin_does_a_kenmore_sewing_machine_use.pdfIn PDF document text
    • https://s3.amazonaws.com/mosezavor/zadop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7e1cb94-3842-4580-8b5f-93ae190e219b/walmart_near_me_hiring_manager.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40e072ad-9fb3-44e4-9d3f-979633822450/lixolubano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b79fd68-b6eb-4a36-b335-cb592d70b970/rebepowipilekexopinon.pdfIn PDF document text
    • https://s3.amazonaws.com/davubewu/sisel.pdfIn PDF document text
    • https://s3.amazonaws.com/sojaxub/python_programming_language_best_book.pdfIn PDF document text
    • https://s3.amazonaws.com/xugigabitulu/skyrim_xbox_one_tips_and_tricks.pdfIn PDF document text
    • https://s3.amazonaws.com/wovugi/57388303560.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aaf0096e-b3f0-405a-b079-d37c8a5ac7e7/hillsborough_county_school_holiday_calendar_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e790.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE790 6416 bytes
SHA-256: 528d1e79c27aec131c2cbf846536b85f4c117e3725d0fa982f5a85159cdab222
font_01_sfnt_off0000f762.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF762 5852 bytes
SHA-256: fc8c87cf3256291afa2686baf2aff97e278ae2463c6aeb76a8273078d5b1404f
font_02_sfnt_off00010b33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B33 11104 bytes
SHA-256: e6e0382227ab5abc78bded06f66bfd7f58f679506273a1aae72eb97a3a32447b
font_03_sfnt_off00012ec5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EC5 10740 bytes
SHA-256: 83e614d44fd42eae6d570ffc0b9a1de7010bfbdc202b53577a896126d7286fd0
font_04_sfnt_off0001538d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1538D 16256 bytes
SHA-256: 8cc6bcc2cf3defe0a88aedbd81e1c3d6ddceaf294630c8a268e5b6d92b2eedfb
font_05_sfnt_off000168ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x168EA 1736 bytes
SHA-256: 0d9b6ab0354368cdfa5a4e52e4dfb250ede80cec4283e48fafec0a3c1c1d30df

Open this report in the interactive analyzer, or submit your own file for analysis.