Malicious PDF — malware analysis report

Static analysis result for SHA-256 00036d9c67016b5a…

MALICIOUS

PDF

67.9 KB Created: 2021-10-01 18:04:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: dfd4d13eda1ff71705f607304ffd85ae SHA-1: f3ffbc184fc6cad951ab88fa57b0b06c30415c76 SHA-256: 00036d9c67016b5a997742856adffc97ff51bfaaa2629059101cd2d0473efdc4
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF file identified as malicious by an ML classifier. It contains numerous embedded URLs, many of which point to disposable domains and are part of a link farm, suggesting a deceptive purpose. While no scripts were directly extracted, the PDF structure and embedded URIs indicate an attempt to redirect users to potentially harmful content or facilitate further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gr-chem.com/upload/files/36058068161.pdf
    • https://tootooair.com/FileData/ckfinder/files/20210913_697A8BFB2B316B45.pdf
    • https://ssmahavidyalaya.org/lion/uploadedfiles/fck/files/file/8388996644.pdf
    • https://bulendengin.com/upload/ckfinder/files/63736888379.pdf
    • https://verandapattaya.com/userfiles/files/89286962005.pdf
    • https://grandhotelushba.com/userfiles/file/11709184824.pdf
    • http://okeefesreef.com/ckfinder/userfiles/files/lukonumulegibaj.pdf
    • https://denimder.org/resimler/files/78427142378.pdf
    • https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/70ffde4f948d36375e68fd4d5ab33113/36106016916.pdf
    • https://oglethorpeclub.org/~oglethor/UserFiles/file/47792510586.pdf
    • http://cieplej.pl/imgturysta/file/96667772234.pdf
    • http://www.yankey.com.tw/demo/public/editor/ckfinder/upload/user_upload/files/37047833976.pdf
    • https://produktybhp.pl/pliki_user/File/28910804255.pdf
    • http://xinchenfast.com/upload/file/penuwul.pdf
    • https://noventa.cz/media/files/file/4480958090.pdf
    • https://adeptos.clevercloud.pt/images/items/files/61037931239.pdf
    • http://tutek.eu/userfiles/file/powepareni.pdf
    • http://balmybnb.com/t/tutorfirm/uploads/ck/files/kagazawewufowozademiguli.pdf
    • http://gachmenminhchien.com/media/ftp/file/ditamozaguvesi.pdf
    • http://rheinmotel.com/userfiles/file/tuvokuk.pdf
    • http://www.hotel-margherita.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613db8d93cc9b---34077155385.pdf
    • http://fireprovietnam.net/luutru/files/vadovawerisoladirativo.pdf
    • https://tarzminder.com/resimler/files/zodiregesofusojoji.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=gigl+app+for+android
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ac9c.bin
32e8f5e0336d5a333ab24da49d3ceac8b1e42afe0afd8ba574f2a98695ac5838		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAC9C 10312 bytes
font_01_sfnt_off0000c3b0.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC3B0 16792 bytes
font_02_sfnt_off0000dbc2.bin
2bef598a74c613b24dc8c209fa08ffa6a100fd8d826e650457a9bfe88ec5584f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBC2 15464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.