Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bc34cdc27532e0e…

MALICIOUS

PDF

82.1 KB Created: 2021-03-27 17:55:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 75bae7fb6644af4910b9dffc223bcee6 SHA-1: 947afe23fdb1a573803a27f76938f1f63d05aa8a SHA-256: 3bc34cdc27532e0e2280f375f5ae4c63ec203b44229f5f254d63e0e87c9a5977
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is identified as malicious by an ML classifier and contains numerous embedded links, many pointing to suspicious domains. The heuristic PDF_SEO_LINK_FARM indicates a large number of external links, suggesting a link farm or SEO poisoning attempt. The PDF_SUSPICIOUS_LINK_LURE heuristic further highlights invisible links to malicious domains, disguised within what appears to be a worksheet. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristics suggest an attempt to redirect users to malicious content, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=phases+of+the+moon+reading+comprehension+worksheet
    • https://lelopotive.weebly.com/uploads/1/3/0/7/130738546/c367f189a.pdf
    • http://mavpa.fun/why_is_my_jbl_speaker_not_workinglrbyv.pdf
    • http://securitycheckingbrowservkcom.xyz/39678694221nxtcd.pdf
    • https://mokekisinuru.weebly.com/uploads/1/3/4/3/134366850/540473.pdf
    • https://notalajamuneno.weebly.com/uploads/1/3/1/3/131378915/8993832.pdf
    • https://loroxiboziniluz.weebly.com/uploads/1/3/4/4/134402159/1479496.pdf
    • https://kiparefewegapip.weebly.com/uploads/1/3/2/6/132682538/3319068.pdf
    • http://winwites.space/36497524814un7cx.pdf
    • http://copyright-central-media.com/belmont_report_principle_of_respect6m5s1.pdf
    • http://argo-tourism.com/xakobuxagelikupamold068.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/goneduzum/horoscope_apps_for_android_phones.pdf
    • https://s3.amazonaws.com/tojazudibumogab/graco_my_ride_65_lx_installation.pdf
    • https://s3.amazonaws.com/jujadodedaruxix/dadajesewo.pdf
    • https://s3.amazonaws.com/tunenijexe/mewawezuvuxebubad.pdf
    • https://s3.amazonaws.com/tufitijinexu/pandoc_markdown_table_to.pdf
    • https://s3.amazonaws.com/remufuzu/comma_splice_test.pdf
    • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_edda38de662f49d28af8cd7a881b034a.pdf?index=true
    • https://d896c2b7-539c-4146-aa8a-b39d26e096d8.filesusr.com/ugd/a98ecc_e255d970ced64ad685ecc46b552297eb.pdf?index=true
    • https://s3.amazonaws.com/kisagoz/what_is_continuous_steady_pace_training.pdf
    • https://s3.amazonaws.com/nawuvud/12393127271.pdf
    • https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_35e1e644c955439d8dd064620463fb4b.pdf?index=true
    • https://s3.amazonaws.com/bagokiko/how_to_view_sheet_tab_in_excel.pdf
    • https://35e1cc1d-5f6c-4a41-9b1b-b9ae8dddc97a.filesusr.com/ugd/351eee_1f78276dea89433e965147189b37f402.pdf?index=true
    • https://s3.amazonaws.com/vitelitubovuluj/can_you_lose_weight_doing_trx.pdf
    • https://s3.amazonaws.com/fosagoba/gizagukilefilokogug.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101d7.bin
2e76bdd929dc85f82bb8cdc2f51f39832b177115e57c66d689d985500af8d72c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101D7 5696 bytes
font_01_sfnt_off00011522.bin
35c64cf30190550e3dd61c9e3fd857354d622973853909f88f6c865401120d84		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11522 10984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.