Malicious PDF — malware analysis report

Static analysis result for SHA-256 01ed42562e425ce9…

MALICIOUS

PDF

72.3 KB Created: 2021-10-03 07:57:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-27
MD5: 8b1d3bcb503ad6bf831abb5f097cb081 SHA-1: d75fb4f0ecd73f5269728017ba3a7d20d9d0dc34 SHA-256: 01ed42562e425ce930f8aa40f76c119349924eb02c2802d7a7a9a3fc313ee32c
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs pointing to various PDF files hosted on different domains, indicating a link farm or distribution network. The ML classifier strongly flagged this PDF as malicious. The presence of external URIs and the link farm heuristic suggest a malicious intent, likely related to SEO manipulation or serving malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/uplcv?utm_term=bullet+physics+download PDF link annotation
    • https://araprinter.com/ckfinder/userfiles/files/85581526194.pdfIn PDF document text
    • https://phoenixturkey.com/upload/ckfinder/files/jakip.pdfIn PDF document text
    • https://nenmongdangquang.com/upload/files/fefajovoneterozefu.pdfIn PDF document text
    • http://wbbray.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614555cf0a41f---20343235303.pdfIn PDF document text
    • http://tongrentangthai.com/UserFiles/file/giripip.pdfIn PDF document text
    • http://ratchadatitan.com/UserFiles/File/vadedif.pdfIn PDF document text
    • http://lepetitjaunais.com/userfiles/file/nemukerepobajejoti.pdfIn PDF document text
    • https://www.scmsgroup.org/ckfinder/userfiles/files/93050612010.pdfIn PDF document text
    • https://darshanam.com/ckfinder/userfiles/files/vomaxakexasanogu.pdfIn PDF document text
    • http://pegasomeeting.medcoast.net/ckfinder/userfiles/files/65708083354.pdfIn PDF document text
    • http://xn--e1aazeoc7d.xn--p1ai/images/shared/file/kukolezipazaxojupeduki.pdfIn PDF document text
    • http://bangtaisay.com/uploads/userfiles/file/21824870396.pdfIn PDF document text
    • http://volareinmongolfiera.it/userfiles/files/lexunalizajofe.pdfIn PDF document text
    • http://tweddlefoto.com/files_contenidos/upload/files/58229290048.pdfIn PDF document text
    • https://adian.eus/files/galeria/files/tomutulagazugivigex.pdfIn PDF document text
    • http://dragonspond.com/uploads/files/32965382693.pdfIn PDF document text
    • http://birzebbugastpetersfc.com/files/file/76889271766.pdfIn PDF document text
    • http://domoticasociale.it/immaginiNewsletter/file/99109022110.pdfIn PDF document text
    • https://nhabe.com.vn/ckfinder/userfiles/files/vezowakitifotigoxabol.pdfIn PDF document text
    • http://stroynerud-sm.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16133a4243f980---36959204424.pdfIn PDF document text
    • https://atlas-consulting.ro/fckeditor/fisiere/file/zozotasovivubotema.pdfIn PDF document text
    • http://anindecor.pl/files/file/sukewesofajefopetas.pdfIn PDF document text
    • http://bmcnx.com/userfiles/file/gasorukafejetavafifuwumu.pdfIn PDF document text
    • http://www.naraihillgolf.com/admin/userfiles/file/84290562158.pdfIn PDF document text
    • https://samngaimarble.com/html_upload/file/jaxezikujotoneviro.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b556.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB556 17184 bytes
SHA-256: 23d427a44873240e935ee2a9e985c1db3db15a23d92e617742743b06a0640e5e
font_01_sfnt_off0000e22c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE22C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000fa43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA43 10864 bytes
SHA-256: fe586831d8506c17aaa16a26ffcb628eb08912dac3cb3cddcd1777c668538b6f

Open this report in the interactive analyzer, or submit your own file for analysis.