Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a6e2a5fe07da171…

MALICIOUS

PDF

85.6 KB Created: 2021-03-13 16:47:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ef7de9b8b05f8198f9d1de46dcbd184 SHA-1: e1f1fe6755d0a3bf4b6ca87de77430a73fc35992 SHA-256: 2a6e2a5fe07da17145f12c89cc9c3e93fae17427185f6b2181109f59c103fd9e
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many pointing to disposable hosting and potentially malicious domains, suggesting a phishing or malware distribution attempt. The ML classifier strongly flagged this PDF as malicious. While no scripts were directly extracted, the PDF structure and embedded URIs indicate a pattern of luring users to external sites, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=metroid+2020+nasa
    • http://websporizlehd.com/cebuano_bible_free_offlineslzb2.pdf
    • https://cdn.sqhk.co/nusatabi/gc5hagh/superhero_logos_printable_coloring_pages.pdf
    • http://lnstagram-verifedbadge.com/what_personality_type_goes_best_with_intjpnvmk.pdf
    • http://islandlandscapesbb.com/4027214885597x0s.pdf
    • https://cdn.sqhk.co/pujapipiwat/jd6icgj/12185396398.pdf
    • https://cdn.sqhk.co/vorebilifi/YNjbhd9/drop_it_low_for_jesus_instagram.pdf
    • https://cdn.sqhk.co/kanemili/aybEQXL/how_do_you_kill_a_creeper_with_arrows.pdf
    • https://cdn-cms.f-static.net/uploads/4479460/normal_6047d6c1ee6c3.pdf
    • https://cdn-cms.f-static.net/uploads/4388824/normal_601dcb9f15680.pdf
    • http://badgesverified.com/7221691815124xuk.pdf
    • https://cdn.sqhk.co/wezufunin/fCCsmji/farming_simulator_14_mods_free_download.pdf
    • http://xavelodezazil.iblogger.org/aace_guidelines_adrenal_incidentaloma.pdf
    • https://cdn-cms.f-static.net/uploads/4416675/normal_603c2011e4a41.pdf
    • http://fezibinuzot.iblogger.org/gizifodunoneno.pdf
    • http://qunit.space/does_samsung_55_inch_smart_tv_have_bluetootht1wz6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_b56afcfe71584cec8d66fef7758d2039.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e50f89aa-0773-4b83-866a-818132e4b418/how_to_fill_a_hoover_steamvac.pdf
    • https://uploads.strikinglycdn.com/files/5d660bda-2e91-49f5-9ced-173e888d138e/sample_machine_learning_projects_in_python_github.pdf
    • https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_4d52166220f6446db29de9fe97f91d86.pdf?index=true
    • https://uploads.strikinglycdn.com/files/24444367-5c19-4171-9e49-2775092f2102/how_to_fix_graco_simple_sway_swing.pdf
    • http://botixegaminolol.rf.gd/3639190993.pdf
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_d98329e9505c4cfdbb9c809f0ebe06a8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/54ab53e9-a6a8-4462-89da-bdfb9eda4dd9/jaybird_x2_wont_pair_with_iphone.pdf
    • http://gafibis.epizy.com/bspp_thread_standard.pdf
    • https://ef90beaa-bca2-431e-862c-49c19dd94618.filesusr.com/ugd/06497e_999041018db94e9ca819314f070832cd.pdf?index=true
    • http://tixuxunu.epizy.com/bozoredegipazigofite.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f9d.bin
b7fc64284a9552ce154c6288d49be75272355e79a5fdc67a98229fac80710582		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F9D 5068 bytes
font_01_sfnt_off000120ed.bin
060e188b626c8c4268ee7f370acdfb05c461d59cce93c986bdec9bd06b3566b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120ED 11392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.