Malicious PDF — malware analysis report

Static analysis result for SHA-256 10f2d783c6fd0e96…

MALICIOUS

PDF

105.8 KB Created: 2021-05-06 21:10:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: 824b3817d7402ad7eebff493195bcf7a SHA-1: c62a030fdc5561eb762919c26388e36fd2fd36dd SHA-256: 10f2d783c6fd0e9681cf87c2cb92fc421382fdaf817520aaec80f67f561730a7
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which point to disposable domains and are flagged as part of a link farm. The ML classifier strongly indicates maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest an attempt to redirect users to potentially malicious sites, likely as part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=android+app+development+price+in+pakistan PDF link annotation
    • http://pokawibu.iblogger.org/giovanni_civardi_drawing_human_anatomy.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474222/normal_60225497f0360.pdfIn PDF document text
    • http://voseritulugit.iblogger.org/78572423210.pdfIn PDF document text
    • http://xevusezes.medianewsonline.com/rajudegigezu.pdfIn PDF document text
    • http://jukejed.mypressonline.com/pancreas_histologia.pdfIn PDF document text
    • https://cdn.sqhk.co/gilisuvunu/iSjcIij/play_forward_assault_on_pc.pdfIn PDF document text
    • https://cdn.sqhk.co/gatavikap/dgfihMd/77768134394.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378152/normal_603e3f0703279.pdfIn PDF document text
    • https://cdn.sqhk.co/jirowolad/hgidghF/free_download_rayman_jungle_run_for_pc.pdfIn PDF document text
    • https://cdn.sqhk.co/nivodoruw/aXie6ha/61379529575.pdfIn PDF document text
    • http://sibatike.getenjoyment.net/math_shapes_worksheets_2nd_grade.pdfIn PDF document text
    • https://cdn.sqhk.co/naludibeg/ggiFMX1/download_transport_empire_steam_tycoon_mod.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450356/normal_605a8c09917a0.pdfIn PDF document text
    • http://dogopanasukodum.22web.org/lipumuzisam.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mapesag.epizy.com/bimokorejupalima.pdfIn PDF document text
    • http://koguxegutoxexu.rf.gd/why_is_a_graphic_organizer_important.pdfIn PDF document text
    • http://lalamufimovisex.epizy.com/najafodixepav.pdfIn PDF document text
    • http://tuvakaj.epizy.com/dororagitolawotafizuraf.pdfIn PDF document text
    • http://wivaxodi.onlinewebshop.net/apcob_notification_2020_download.pdfIn PDF document text
    • https://18cceff7-6d50-42ec-9d85-67184b61345e.filesusr.com/ugd/8c2e83_37ac7a84e24241be89d0a02763cdce08.pdf?index=trueIn PDF document text
    • https://d6504552-49b0-4b7d-b1ff-94f9e1082b83.filesusr.com/ugd/1f0558_dbb4e3abed0e4c6f9c1b44dab67d02ec.pdf?index=trueIn PDF document text
    • http://wurebosuloxu.myartsonline.com/restaurant_manager_roles_and_responsibilities.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000148b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x148B0 5332 bytes
SHA-256: f828affe4964ba6754b72e5bde7d0d5862abf262ae574c234d9b5fb85953fd1b
font_01_sfnt_off00015ac5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15AC5 11948 bytes
SHA-256: 4a301660c085dfec7b49664a18c11d1087b4c709c5d03ab8dafcf1ad6a4571da
font_02_sfnt_off0001837e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1837E 16204 bytes
SHA-256: 532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e

Open this report in the interactive analyzer, or submit your own file for analysis.