Malicious PDF — malware analysis report

Static analysis result for SHA-256 20ef46d2ecc1b467…

MALICIOUS

PDF

74.0 KB Created: 2021-03-18 00:06:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f2602cea841651e23b79bf1e64d94b5 SHA-1: d8ca7f397b4aa2a6c679481f7318c87d587693dd SHA-256: 20ef46d2ecc1b46719ae675d4b47a307928e76d1f2aa82c1a89868d6efe0fc0c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, indicating a link farm or distribution mechanism. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple external URIs suggests an attempt to redirect users to malicious content or facilitate further downloads. No scripts were extracted, but the overall structure and URL patterns are indicative of a malicious distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=death+of+a+nation+download
    • http://nurigoluda.mygamesonline.org/ashraful_insha_download.pdf
    • http://povisowalikim.scienceontheweb.net/bsc_zoology_honours_book_download.pdf
    • https://cdn.sqhk.co/baxemazisod/7pxicig/gebipapuraxufabekolowaj.pdf
    • http://nipawifaxupus.mygamesonline.org/tafejixopirugazap.pdf
    • https://cdn.sqhk.co/rorajakura/fhfgchj/vikings_spin_off_valhalla_cast.pdf
    • https://cdn.sqhk.co/lojosewude/S4hh6hi/ube_crinkle_cookies_for_sale.pdf
    • https://cdn.sqhk.co/darojopul/Njfhexm/sativewo.pdf
    • https://cdn.sqhk.co/kofelejezem/O723Kij/suvoturuvozusurosi.pdf
    • https://nosovaranipad.weebly.com/uploads/1/3/4/7/134743093/bccef3af420.pdf
    • https://vudaxevagi.weebly.com/uploads/1/3/4/2/134234865/bowuxovoze_jotajawujuzolo.pdf
    • http://fozogadixanemo.iblogger.org/73068251494.pdf
    • https://cdn.sqhk.co/vovewotutal/jWjarii/slice_of_life_anime_movies_netflix.pdf
    • https://cdn.sqhk.co/xororofomed/REhgLA3/kefokojoxoge.pdf
    • https://cdn.sqhk.co/bidekidarub/c2QckbA/mens_hairstyles_long_on_top_curly.pdf
    • https://cdn.sqhk.co/puvivefujef/hihbujg/letifomoluramepusive.pdf
    • http://fewudutizoxom.medianewsonline.com/kuxifusejaf.pdf
    • https://cdn.sqhk.co/xixumobun/yp8gjgh/screen_recorder_videoshow_with_audio_video_editor.pdf
    • https://cdn.sqhk.co/xudapurofoz/gfzkphi/tipping_point_blast_lucky_coin_pushers.pdf
    • https://cdn.sqhk.co/puvivefujef/hihbujg/letifomolu
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zidazimimaf.epizy.com/suzumogowu.pdf
    • http://xufoturimixeb.epizy.com/vuxigepapawa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d03a.bin
5e96c0b66e0a9c86fb13cf2e0f58b290354be03c2ea4822979e68a19d1fc65ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD03A 4812 bytes
font_01_sfnt_off0000e0b5.bin
c69c3864a0d68bfa7e5d12668f4d8bd8029b18f1d6768430d0b6816aae4811f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE0B5 10792 bytes
font_02_sfnt_off000105b6.bin
4f6d6443d667672870c38ce4e1d364e29e61a0df6fd2d8217a47270b9fff04c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105B6 16132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.