Malicious PDF — malware analysis report

Static analysis result for SHA-256 33871c36c270e4e5…

MALICIOUS

PDF

79.7 KB Created: 2021-05-27 22:57:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 25d310fa6d56d76276231dd1856dea0e SHA-1: 2808086c8db9ca4853d04d017e7ea8e064101089 SHA-256: 33871c36c270e4e5cbef91e14293e4e9bfacb52319008701a4eb44e2994e8316
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded external links, primarily pointing to other PDF files hosted on Weebly. The heuristic 'PDF_SEO_LINK_FARM' indicates this is a deliberate attempt to create a link farm, likely for SEO manipulation or to distribute malicious content. While no scripts were directly extracted, the nature of the embedded links suggests a potential for further malicious activity or redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gutavavoz.weebly.com/uploads/1/3/4/0/134000423/bajubutu-sijit-kulawiwumedud.pdf
    • https://cdn-cms.f-static.net/uploads/4457586/normal_5fda6c1e7e733.pdf
    • https://puvapimasekasu.weebly.com/uploads/1/3/4/3/134398754/vevexifafisowo.pdf
    • https://gojolukok.weebly.com/uploads/1/3/4/4/134455450/kidupuzokoj-tusizemixovivi.pdf
    • https://turumokapitaka.weebly.com/uploads/1/3/4/6/134613572/8435882.pdf
    • https://static.s123-cdn-static.com/uploads/4382952/normal_5fec6178db073.pdf
    • https://bivajeliju.weebly.com/uploads/1/3/5/9/135978375/robudifo.pdf
    • https://tavimemake.weebly.com/uploads/1/3/7/5/137513296/709009.pdf
    • https://mokawipo.weebly.com/uploads/1/3/4/2/134234768/lurewinujafawiw.pdf
    • https://cdn-cms.f-static.net/uploads/4390056/normal_60128dda3e75e.pdf
    • https://miruvogix.weebly.com/uploads/1/3/1/4/131408245/nejidodujeve.pdf
    • https://filuvinuro.weebly.com/uploads/1/3/4/4/134455556/jawogatul_jewokime_wonuj_janoki.pdf
    • https://devonejejarib.weebly.com/uploads/1/3/4/6/134608322/6747497.pdf
    • https://sezitekiporav.weebly.com/uploads/1/3/4/6/134627959/xovepiwojoze.pdf
    • https://xexogabowagub.weebly.com/uploads/1/3/4/4/134438270/timono_sikufamux_mipemex_sifer.pdf
    • https://vurerabekude.weebly.com/uploads/1/3/4/4/134493837/bfc4ee87e3.pdf
    • https://neveloso.weebly.com/uploads/1/3/1/4/131408616/8140385.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://feedproxy.google.com/~r/wb/ENAH/~3/G1IkLG9TFNM/wb?keyword=the%20ruby%20on%20rails%20tutorial%20learn%20web%20development%20with%20rails%206th%20edition
    • https://uploads.strikinglycdn.com/files/f952951e-e7cf-4051-b510-56e5df1e644a/amd_a4_9125_radeon_r3_drivers_download.pdf
    • https://uploads.strikinglycdn.com/files/b9a806d2-eda1-44b4-84cb-2e961c2004dd/74650472484.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f861.bin
d65a72f9b38aa295c2062e9d4bba5d4ca1377c8d75ffbbf4e9eda4c8de3e980c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF861 5696 bytes
font_01_sfnt_off00010bac.bin
22d978541d644d4a25018d6f808d8f35223dc00728166879c46c95de8d94e42d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BAC 10840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.