Malicious PDF — malware analysis report

Static analysis result for SHA-256 3965963fdce926e1…

MALICIOUS

PDF

81.5 KB Created: 2021-03-08 05:19:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: acb6e986d6f5efae741d2b7ff23ac9f5 SHA-1: bf840052824436898c445cf57059a275240f52ad SHA-256: 3965963fdce926e13725d989a02b2b99b062f346565dfaf9987fa2cd77336323
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains numerous embedded URLs, many pointing to disposable hosting and link farms, indicating a phishing or spamming campaign. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to redirect the user to a potentially harmful site. No scripts were extracted, but the overall structure and URL distribution are indicative of a malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=lg+top+load+washing+machine+drain+filter PDF link annotation
    • https://cdn.sqhk.co/gulifunanale/TiiicKr/jackie_chan_the_kung_fu_master_mame_rom.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416495/normal_5fc5eb94b6b20.pdfIn PDF document text
    • https://cdn.sqhk.co/buvaboda/hcihhix/talking_tom_wallpaper_apk_old_version.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380214/normal_60131800be0ad.pdfIn PDF document text
    • https://cdn.sqhk.co/kajipazuto/fuIiijb/zovupajowuw.pdfIn PDF document text
    • http://wagugekewa.22web.org/format_bootable_usb_ubuntu_18._04.pdfIn PDF document text
    • http://therarbooks.com/16291557639tmd05.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413242/normal_5fe74d92cda6d.pdfIn PDF document text
    • https://cdn.sqhk.co/raxuzuvuluf/philha3/ice_age_adventures_game_online.pdfIn PDF document text
    • https://cdn.sqhk.co/banuluwopote/1Ngdqjc/36426689868.pdfIn PDF document text
    • https://cdn.sqhk.co/mujutuzidip/upjczzz/modern_critical_warfare_action_offline_games_2018_mod.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486033/normal_5fd878452c705.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424013/normal_600a059d79557.pdfIn PDF document text
    • http://keksik24.ru/toner_fr_hp_laserjet_4050_n185wi.pdfIn PDF document text
    • https://cdn.sqhk.co/kigaratak/CFjfifD/vudufuvedofubufiximu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa5ec486-8272-406d-9e9f-d3427332d68d/pewisewixununedesimixewuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6473d642-e376-4b2b-a20e-f06016d85897/acer_chromebook_15_price_in_pakistan.pdfIn PDF document text
    • http://kadegezopofog.rf.gd/42772261968.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b307319-56f1-4a75-9347-c69a04edcf7c/25690783197.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f511bbb-82ff-41b9-beac-d60b9c91cd7c/jutetufelegekabaw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001009a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1009A 5604 bytes
SHA-256: fdf94c0aabc79486217f355046362f483fcb7bcdea3ae96f6c2c28bc5dcebce6
font_01_sfnt_off00011390.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11390 11300 bytes
SHA-256: 2c1b2ba83b2995265eccb6a8cc401019cf47dcd7113b9061148a278320a8a308

Open this report in the interactive analyzer, or submit your own file for analysis.