Malicious PDF — malware analysis report

Static analysis result for SHA-256 35eb7b055f550165…

MALICIOUS

PDF

89.7 KB Created: 2021-03-19 04:46:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 83d46ce6d1b5f6bfe4db7b3f8e54a798 SHA-1: a538db7f6be6385dce1237f6b82890fd1db4498f SHA-256: 35eb7b055f5501652fb58f2542cb183e16609076f789463b092bafe15ba4f5d1
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable hosting, suggesting a link farm designed to manipulate search engine results. One of the embedded URLs, 'https://resalured.ru/strik?utm_term=hans+wehr+dictionary+fourth+edition+pdf', is likely part of this scheme to drive traffic to potentially malicious or spammy content. No scripts were extracted, but the PDF structure and link farm heuristic indicate a malicious intent to mislead users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=hans+wehr+dictionary+fourth+edition+pdf PDF link annotation
    • http://xevijuwidenuxet.mypressonline.com/40360511234.pdfIn PDF document text
    • https://nexawukuvinu.weebly.com/uploads/1/3/4/5/134578226/3de01.pdfIn PDF document text
    • http://tufofol.medianewsonline.com/bevolebagofev.pdfIn PDF document text
    • http://logusubunovad.22web.org/how_to_write_a_storyboard_for_short_film.pdfIn PDF document text
    • http://pedaxofanor.mywebcommunity.org/64862377241.pdfIn PDF document text
    • http://defokozixeral.sportsontheweb.net/what_is_the_literature_review_section_of_a_research_paper.pdfIn PDF document text
    • https://wufikaxom.weebly.com/uploads/1/3/4/8/134883002/2532035.pdfIn PDF document text
    • https://dosupara.weebly.com/uploads/1/3/1/3/131380612/bowolaruda.pdfIn PDF document text
    • https://lamamamim.weebly.com/uploads/1/3/1/6/131606140/gofasojomoxiduvav.pdfIn PDF document text
    • https://pefizisiguxuv.weebly.com/uploads/1/3/1/4/131438819/tivavidabetotiba.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://5a060084-92f5-4e09-b02e-bbac8bb45871.filesusr.com/ugd/05c943_cde2f5aac1ac4ea98ee9e5bdf763898a.pdf?index=trueIn PDF document text
    • http://lojifasipok.rf.gd/bebuforozage.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f8b2992-698d-4b0d-809a-b20108c2d6b9/tuck_everlasting_story_summary.pdfIn PDF document text
    • https://85377554-d84f-42a6-a955-c87f7d5d3d8c.filesusr.com/ugd/dd4472_7e0f7224c6fc4e1693bec5118a8b236c.pdf?index=trueIn PDF document text
    • https://3a0d5408-2ea1-4258-8d29-5d96341cad2c.filesusr.com/ugd/79cb75_e2bd3fcd0d574a9c940946c6bc56d66a.pdf?index=trueIn PDF document text
    • http://xowevabi.epizy.com/xixoroginisuvo.pdfIn PDF document text
    • http://jubogaju.atwebpages.com/why_is_my_fios_router_blinking_blue.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64169ac1-d700-431e-886e-95f0d9404168/sivoresituferiwumi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fba47c1c-73a6-4269-838e-e02a997e9fac/mudirakuf.pdfIn PDF document text
    • https://d2d87fd5-5f4d-49aa-ab3c-2263ce4b5d22.filesusr.com/ugd/9169d2_c0093760060d46ed824ff6fd2d321356.pdf?index=trueIn PDF document text
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_dc6c5e8dcb0d41a5a13e94e1ce39580c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f260ad84-8b8c-4bf7-aca5-3b33f5b2bc7b/gegitik.pdfIn PDF document text
    • https://59b7e61f-9850-45ee-add2-e9646db267e4.filesusr.com/ugd/5b9365_d539545f30064aa09424dea9379ce4d8.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b979ed4-1d7d-498c-9e23-091145c8a277/lugejomifate.pdfIn PDF document text
    • https://6baea7ca-81e4-4a11-8410-716433a99462.filesusr.com/ugd/764aaa_36e2b5577d2e40d09029fdc6b0ec33af.pdf?index=trueIn PDF document text
    • https://5e024257-ca51-40df-b6b5-a3104c7b7124.filesusr.com/ugd/97368a_2c2c915ac3e043d6b1abf5dfa6c8eafd.pdf?index=trueIn PDF document text
    • http://gimusatis.rf.gd/android_accelerometer_sensor_distance.pdfIn PDF document text
    • http://lokimutopilar.epizy.com/82657483842.pdfIn PDF document text
    • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_ac765c36410b48b19f65e06371e9bdb7.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBB7 5368 bytes
SHA-256: 4da926168958f9a126a50bbd08619a3c4f9072cc82fd862bb2f70b00a301bf87
font_01_sfnt_off00010e0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E0E 12948 bytes
SHA-256: 802f34d95a30b807d36d83fd1bf3bceff37ca0d62235f976fe213a6e1784a114
font_02_sfnt_off0001379a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1379A 19476 bytes
SHA-256: ea73f5edd915ce2592ca03dfcb7f8222e6555c2df9c02dfe47a1fe64f5c3b779

Open this report in the interactive analyzer, or submit your own file for analysis.