PDF malware analysis — malicious · 2e83bc32a9946dba

MALICIOUS

PDF

85.2 KB Created: 2021-03-28 02:39:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07

MD5: a80bc4b812df09f850f1e3dedc1249d5 SHA-1: 419e8247b313a03db9958f140111e9f8766b451a SHA-256: 2e83bc32a9946dba0cfdebc85cb63cb94641087e67b15530255f85f7a8a77c48

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for PDF_SEO_LINK_FARM, indicating it is part of a network of links designed to manipulate search engine results. It also contains an external URI pointing to a website that appears to be related to appliance manuals, likely a lure. The ML classifier strongly flagged this PDF as malicious. No scripts were extracted, but the overall structure suggests a malicious SEO link farm or content locker.

Machine Learning

Nyx PDF Classifier malicious score 0.9954

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/wix?keyword=electrolux+oven+manual+change+time PDF link annotation
- https://static.s123-cdn-static.com/uploads/4407102/normal_6003a516320a8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464877/normal_60581303f0877.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393018/normal_603d89c9ca585.pdfIn PDF document text
- https://cdn.sqhk.co/rojozedofaf/jeuigif/23648288142.pdfIn PDF document text
- https://cdn.sqhk.co/rufosopufu/ogcNzih/commercial_bank_of_ethiopia_diaspora_mortgage.pdfIn PDF document text
- https://cdn.sqhk.co/mekibekowufe/CGpdgel/80015156106.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417408/normal_6038e93ebf375.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/voxulija/why_wont_my_ihome_portable_charger_charge.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/97830d60-8d25-499b-8113-21552ba6a8f8/troy-bilt_storm_2410_2_stage_24_in._snow_blower.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d6622459-8461-4490-b8f9-5e57ec7839d4/resea_del_libro_100_aos_de_soledad_de_gabriel_garcia_marquez.pdfIn PDF document text
- https://s3.amazonaws.com/tezofuretejom/35179560847.pdfIn PDF document text
- https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_77dcf77afe9e41b590f0d86ce0239233.pdf?index=trueIn PDF document text
- https://abf133a7-37c0-4616-b653-d99fd306bce3.filesusr.com/ugd/5c8236_ffabc7a6c8b7407595c1eb1834caa7fc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wemazun/zofakapiwozikegu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aeb7c1b9-be91-412f-8b0a-88c8df4e60e2/biddeford_electric_blanket_auto_off.pdfIn PDF document text
- https://s3.amazonaws.com/kisimujuk/babogesilonilujarodojeg.pdfIn PDF document text
- https://s3.amazonaws.com/fifuto/mallow_weed_herbiguide.pdfIn PDF document text
- https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_5b429058a4eb4593a01e9e653fdb795d.pdf?index=trueIn PDF document text
- https://39ad70c8-6a03-4de2-a89b-b0209cba5754.filesusr.com/ugd/d2759c_9e2fe9b108894e889172627ea3247031.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/topipovikapari/ip_camera_scanner_software.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb204234-6545-4ae7-b207-2ac66649abc7/muvunisenuzig.pdfIn PDF document text
- https://s3.amazonaws.com/nawosineromigi/nulivuju.pdfIn PDF document text
- https://s3.amazonaws.com/wizuluworafid/binomische_formeln_zusammenfassen_rechner.pdfIn PDF document text
- https://s3.amazonaws.com/mexesazaxasa/80190364895.pdfIn PDF document text
- https://s3.amazonaws.com/zasepo/bukunmi_oluwasina_latest_videos.pdfIn PDF document text
- https://c93e3e17-565c-496b-95a0-45fea83b015f.filesusr.com/ugd/cd9bb8_658d540e2f11440d9a7354df1c07c844.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001060f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1060F	5120 bytes
SHA-256: `1a1cd4a14b4cf675169eb3eaedf461f712207d17b13b5e300471037e17ae9007`
`font_01_sfnt_off00011752.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11752	1800 bytes
SHA-256: `51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0`
`font_02_sfnt_off00011fe0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11FE0	11320 bytes
SHA-256: `6b122ec37d461928123f9909fb998b9b0b8c686ec87329a77a59842ebe430521`

Open this report in the interactive analyzer, or submit your own file for analysis.