Malicious PDF — malware analysis report

Static analysis result for SHA-256 348563abcff63383…

MALICIOUS

PDF

74.7 KB Created: 2021-03-28 11:40:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 53a7c81b2b7ce20a35e605c4686e5a5c SHA-1: bc54d285250120e9891f4b47c46418f90783605c SHA-256: 348563abcff63383712406c6c5517f86ed946e2eba9249002e30333f36abc4d2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a significant number pointing to potentially malicious domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The embedded content, though heavily obfuscated, suggests a lure related to a book title. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs further supports a malicious intent, likely to redirect users to a compromised site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=anthology+of+african+american+literature+pdf
    • http://megalit-korolev.ru/the_rime_of_the_ancient_mariner_questions_and_answers7xvr8.pdf
    • http://nopezimugabotik.mygamesonline.org/activity_diagram_for_hotel_management_system.pdf
    • http://novoruxove.iblogger.org/data_science_and_big_data_analytics_emc_free_download.pdf
    • http://foxiduwanati.mygamesonline.org/ccie_security_questions.pdf
    • http://vaxuserinux.22web.org/zikasipobipirujojug.pdf
    • http://usmileofficial.site/64115575651a5ud7.pdf
    • http://tavafotuzefox.sportsontheweb.net/misoxetusosurobewada.pdf
    • http://bobixina.getenjoyment.net/taste_and_other_tales_penguin_readers_level_5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pululusodogi/85543550014.pdf
    • http://mapakipoborepuj.epizy.com/avengers_a_day_game_for_android.pdf
    • https://69f6cc44-9198-4e41-bafa-43503dba92bf.filesusr.com/ugd/dec231_6a895443812a4abf81af34b22d46c9f8.pdf?index=true
    • https://fb4bdcd3-28a3-4206-a6c3-fb267f511c23.filesusr.com/ugd/0ad562_b8726d85fee442aa818049e0524c78bc.pdf?index=true
    • http://xukajipovaru.epizy.com/dead_space_3_free.pdf
    • https://s3.amazonaws.com/kimone/reviews_on_raypak_pool_heaters.pdf
    • https://s3.amazonaws.com/gupojakami/jvc_compact_vhs_camcorder_price.pdf
    • https://s3.amazonaws.com/zupenafud/18609756524.pdf
    • http://bexudigibop.rf.gd/51708210284.pdf
    • https://7a1f2a0d-094a-4466-88af-72a4af93b9fa.filesusr.com/ugd/22739b_86058f359b964dfc860090f3bb4de16a.pdf?index=true
    • http://menenig.rf.gd/samsung_series_6_stuck_in_demo_mode.pdf
    • https://s3.amazonaws.com/vuxagixil/2024730044.pdf
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_765a5e0b652a4f15b33d46b77c197bb1.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e582.bin
cb5208ce1d758b8d59eeaa1543784c345e0c0725fea5587b99e1420bd666a9e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE582 5480 bytes
font_01_sfnt_off0000f80e.bin
49a8508a8c6e2d7444190d03e381f26ab50b6108184930c8ea14ae335dd7d127		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF80E 10904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.