Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c523645e006af57…

MALICIOUS

PDF

83.0 KB Created: 2021-04-04 22:32:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: e8dbaad896e60ad2a03de5be4eda758e SHA-1: b1718730e5024dab3965b2bc4abf9513c2df4c50 SHA-256: 3c523645e006af57021cf2de051888393ff283b5c903b98f6e30b17e40947861
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=difference+between+linear+and+nonlinear+regression+in+data+mining PDF link annotation
    • http://xokapik.mywebcommunity.org/sama_veda_upakarma_2020.pdfIn PDF document text
    • http://supariwepexafat.mywebcommunity.org/assinatura_digital_invalida.pdfIn PDF document text
    • http://kazotapojiwi.mywebcommunity.org/3717202090.pdfIn PDF document text
    • http://boraguw.medianewsonline.com/63919937997.pdfIn PDF document text
    • http://jepenufi.getenjoyment.net/kukolipumapivezonasikuxi.pdfIn PDF document text
    • http://zifixoribe.scienceontheweb.net/80426974515.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xipavir/7339143610.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/bmw_inpa_ifh_0018_initialization_error.pdfIn PDF document text
    • https://557345b1-98c6-442d-b460-9e357c178e5b.filesusr.com/ugd/dfb5f8_0440756b35804911a3c7252663cafc30.pdf?index=trueIn PDF document text
    • https://9df6e0af-a028-4e88-91ba-61a1b37318d5.filesusr.com/ugd/7c1f05_992e6b2e8838471fa93bad564c3a65f2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pukaridimupo/cash_flow_analysis_form_1084.pdfIn PDF document text
    • http://wosakev.epizy.com/add_subtract_polynomials_worksheet.pdfIn PDF document text
    • http://takumoz.epizy.com/tosefilu.pdfIn PDF document text
    • https://ed21222e-fee3-4fab-8b52-e2ddb7bb35ab.filesusr.com/ugd/e73fea_549d968a1b5f4f958b38184a20664cc6.pdf?index=trueIn PDF document text
    • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_74ef3a711881483a97da7fbed2be9870.pdf?index=trueIn PDF document text
    • https://cf62593c-3f62-494e-9ef9-3c2a63ead7d7.filesusr.com/ugd/93dae2_ce70be16f7084fbb96f23f0e24f88c64.pdf?index=trueIn PDF document text
    • https://576979ff-f939-4980-8793-4b7993fae0a8.filesusr.com/ugd/14903d_650ac064da5349df8947b5235ae6401b.pdf?index=trueIn PDF document text
    • https://d62ff7d9-aefc-4ab8-8cdf-af38868aea16.filesusr.com/ugd/54b9a1_b5bd083b699c4c19949870ffa27179f8.pdf?index=trueIn PDF document text
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_6a507a49c5da4d74a5d8412783e4dd47.pdf?index=trueIn PDF document text
    • http://womunek.rf.gd/exercicios_com_numeros_em_ingles_para_imprimir.pdfIn PDF document text
    • https://s3.amazonaws.com/wukara/erk_phosphorylation_reporter.pdfIn PDF document text
    • http://bugazepoja.onlinewebshop.net/bonhomme_allumette.pdfIn PDF document text
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_922137220f9a47ecafbd73ead29bd993.pdf?index=trueIn PDF document text
    • http://saziwujezad.epizy.com/zorita.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010066.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10066 5572 bytes
SHA-256: 85794e68f35698cf66cd5b5a9530fa04011d2d0d1b858c01ea35f2686633f005
font_01_sfnt_off0001135b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1135B 11832 bytes
SHA-256: 452d1be6a488356622d7b1ca5219d2eb1583a6c8c266ac7215593b856c2a4c78

Open this report in the interactive analyzer, or submit your own file for analysis.