Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b4e4c7ea3d9f94f…

MALICIOUS

PDF

76.0 KB Created: 2021-03-10 18:57:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4e38ca29d0f63016356c3ee640764e6 SHA-1: 5f1dae3fdcee87dad13950644d9f627da980deac SHA-256: 0b4e4c7ea3d9f94f0f38f9cab93d93e37399b2a6e6c90fc28550fc214caa65fb
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic indicating a large number of external links, with one prominent URL pointing to a suspicious domain. The document body, though partially corrupted, mentions a song title and the authoring application, suggesting a lure. The ML classifier strongly flagged this PDF as malicious, supporting a phishing or scam attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=chatal+band+dj+remix+song
    • https://cdn-cms.f-static.net/uploads/4489412/normal_600a9a3d1b7ae.pdf
    • http://perevod-card2card24.site/asl_manual_alphabet_printablefaf3x.pdf
    • https://cdn-cms.f-static.net/uploads/4411250/normal_6023e2684fb52.pdf
    • https://static.s123-cdn-static.com/uploads/4498702/normal_6000838c2624c.pdf
    • https://static.s123-cdn-static.com/uploads/4446511/normal_5ff1d06581917.pdf
    • http://xowivek.iblogger.org/bwv_1067_piano_sheet.pdf
    • http://saudiautoinsurance.com/the_gospel_of_thomas_audio_download_freeggegb.pdf
    • http://www19216801.site/59614879201d78qn.pdf
    • http://nakezubelakibe.22web.org/xagewufikutopego.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lunojol/aroon_up_and_down_indicator_mt4.pdf
    • http://zunimesigo.rf.gd/32081021608.pdf
    • https://s3.amazonaws.com/vebogotexaf/simplifying_algebraic_expressions_with_indices_worksheets.pdf
    • https://ed59cdd8-0d75-4634-8bb2-7afdb9da103e.filesusr.com/ugd/9cb112_0b260f55d4a44c04a3e63759680c8119.pdf?index=true
    • http://rolozaj.epizy.com/motigebofa.pdf
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_a59168ceec634f6bb483ee640d741ce7.pdf?index=true
    • https://s3.amazonaws.com/sezebepit/fesadube.pdf
    • https://s3.amazonaws.com/vuzotisenixava/types_of_ceiling_materials.pdf
    • https://s3.amazonaws.com/fekife/rufos.pdf
    • https://b84c3727-5d5a-4c5d-9d5d-21cac87b3a69.filesusr.com/ugd/fdd6c2_9ee795f75f984e0da1d06a88f0a6beda.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb34.bin
deac0d65a3cefbce498c99bb84544dbcb6c5b726f8b2f304ca3cffdda7daac07		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB34 5428 bytes
font_01_sfnt_off0000fd7e.bin
d4e3fa74012c0b50b115bfd0caad30caab8dd1ad391fbef491477480f44c53fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD7E 10852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.