Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a65e4c4cd194bde…

MALICIOUS

PDF

77.5 KB Created: 2021-04-07 19:46:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 2746b2bafe4f6485a3a742c44e749014 SHA-1: e813011331711e8f4e3b80dd76dd87a850f782c7 SHA-256: 2a65e4c4cd194bde8b1e0d1481bda22a9a32a475703a8c2b67ff264c7304a146
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm or redirection scheme. The primary malicious URL identified is https://maypoin.ru/strik, which is likely intended to host a malicious payload or phishing content. No scripts were extracted, but the PDF structure and embedded URIs strongly indicate a malicious intent to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=what+does+2.1+sound+bar+mean PDF link annotation
    • http://dezlice.ru/musipivcgvx.pdfIn PDF document text
    • http://axacheat4.xyz/what_africa_was_called_before68it4.pdfIn PDF document text
    • http://idealicaitalia-official.site/best_dish_receiver_in_pakistan_20204rx0s.pdfIn PDF document text
    • http://kopumiwabetare.66ghz.com/cellophane_fka_twigs.pdfIn PDF document text
    • http://rufejupewanun.iblogger.org/jimuxev.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a50dbba5-e4fd-40cc-afa9-a45495a5accf.filesusr.com/ugd/7f929b_b78e58f79c8b4fa88c16696f84ab8a9e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pegozegi/vunupasilajuzu.pdfIn PDF document text
    • http://xutunebel.epizy.com/koguziramitezi.pdfIn PDF document text
    • https://s3.amazonaws.com/wanalovum/fepevosisuvekunekixaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/608358d6-7565-453d-9aeb-58fe09fda135/pemupelu.pdfIn PDF document text
    • https://b354d503-40d1-4c97-84b4-bc0b16c12f35.filesusr.com/ugd/8c7d07_eeee2298c0f94df3a031c3958413be3f.pdf?index=trueIn PDF document text
    • http://nirobow.epizy.com/tokevubupibavo.pdfIn PDF document text
    • https://s3.amazonaws.com/zufaxepixiguxax/31056905732.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxutedi/a_new_leaf_by_francis_scott_fitzgerald.pdfIn PDF document text
    • https://e0ff2378-281a-4ea3-95ae-419c526fdc99.filesusr.com/ugd/0baf77_2cc60dfc44be466bb0edaaeaa09d0f2e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/41de04a3-dc0f-4a6a-b730-07aeb9784fb1/lufexuxilosinodi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0fbf754b-6cb3-4b2a-b0d2-bf9a64d273a9/atomic_habits_audiobook_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1938436-ef6f-46b2-96ea-fa5a921ac7e2/fimuwofuzupu.pdfIn PDF document text
    • https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_f3e1160288d44c038a26f32137661281.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/baxunaf/pirates_of_the_caribbean_movie_free.pdfIn PDF document text
    • https://s3.amazonaws.com/tiduro/zurajovinidozibenozo.pdfIn PDF document text
    • https://s3.amazonaws.com/posufij/zibagose.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49360d7d-1fbf-4ff5-beeb-263a12f2981d/how_to_set_dye_in_cotton_yarn.pdfIn PDF document text
    • http://gugapuni.rf.gd/84306513967.pdfIn PDF document text
    • https://9fb0fece-6c2a-4f8b-8ff1-5d9ea67f5ee7.filesusr.com/ugd/f6a907_692186ec74284ee8940d2e1994d03774.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f11e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF11E 5404 bytes
SHA-256: 3f5f30364218ee5e2dcbf1d48b23b3d466d01ddd9f77e7761f11acc2c607fa59
font_01_sfnt_off00010362.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10362 10828 bytes
SHA-256: b2a2124229e3af3be6c238de80ebb42e41d0a1b6e14bcbada337804a35e40cf1

Open this report in the interactive analyzer, or submit your own file for analysis.