Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c68b57d91d91407…

MALICIOUS

PDF

84.9 KB Created: 2021-05-17 14:47:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 86aae8de86915db19eae398b4f260c9e SHA-1: 64329f09d609f77ec2c762bc263fe97b6da448dd SHA-256: 4c68b57d91d91407dc8068b3698dd1e692369b948b8ae5a85087eb4e2acf19a2
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many pointing to disposable domains, as indicated by the PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM heuristics. The ML classifier also strongly flagged this PDF as malicious. The embedded document body text is heavily obfuscated and appears to be corrupted, preventing a clear understanding of its intended lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/4497109/normal_606c7c1fc8940.pdf In PDF document text
    • https://fupixadig.weebly.com/uploads/1/3/4/0/134096542/sukimagebejowet.pdfIn PDF document text
    • https://xasejudezorakoz.weebly.com/uploads/1/3/0/8/130813307/7972253.pdfIn PDF document text
    • https://gutamunimidujad.weebly.com/uploads/1/3/4/6/134667749/bolexagimegabudul.pdfIn PDF document text
    • https://zisuwurelexutik.weebly.com/uploads/1/3/4/6/134668326/b48471.pdfIn PDF document text
    • https://pudakivofuleges.weebly.com/uploads/1/3/4/8/134853743/9291614.pdfIn PDF document text
    • https://bafiredevidif.weebly.com/uploads/1/3/1/3/131384403/lupokol.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465270/normal_6056fc5ad8d25.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453342/normal_60468f0274610.pdfIn PDF document text
    • https://fawimerena.weebly.com/uploads/1/3/4/6/134630635/e0a05ce0d5a68.pdfIn PDF document text
    • https://xuwojuzo.weebly.com/uploads/1/3/4/4/134471705/liroruwebifozafi.pdfIn PDF document text
    • https://zepofujokedab.weebly.com/uploads/1/3/5/3/135315754/f8643ad6d201cfe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413968/normal_5fdb252a395f8.pdfIn PDF document text
    • https://zonozedu.weebly.com/uploads/1/3/0/8/130874021/62e28ccf1ab5d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://feedproxy.google.com/~r/wb/ENAH/~3/_7yJ53orglQ/wb?keyword=jandy%20lite2%20pool%20heater%20fl2%20errorPDF link annotation
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_c8b802a28dca449aa5d011034eb732ee.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6deeacb-bd1c-4bcb-ae58-70efb8184a01/64293716514.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b669b184-56e8-444a-895a-40c75d22fa6b/20577849613.pdfIn PDF document text
    • https://43fe4710-460a-4ad3-90dc-2dd795c51528.filesusr.com/ugd/a32c20_b66927ecdfdc4edfbb415655c57ebc77.pdf?index=trueIn PDF document text
    • https://6448a590-b571-4b71-a9e4-820b8531b153.filesusr.com/ugd/782be2_6ecfa7e8f3ed47f89c345661603d392c.pdf?index=trueIn PDF document text
    • https://98e80eac-0673-4bf9-a3de-4132461903b3.filesusr.com/ugd/1acd69_731368b511684ab08a88d3dc4033420a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f2c80c3-21eb-4609-a91c-b07877993f17/eleanor_and_park_movie_2019.pdfIn PDF document text
    • https://aa6d2f86-95e2-42cc-897e-6bbd71c3a116.filesusr.com/ugd/78daac_37fdd918e90d472385de600c5579e09b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/74623447-6fd3-493e-9f77-2023983565be/how_to_figure_out_angles_of_a_rhombus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3c8b8be-5aad-4bad-88c6-ef7803ccdfeb/posufuvumitora.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001028b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1028B 4960 bytes
SHA-256: 5b7b593de41a9667ad5769724d2fd1cd5f9cedad95f6a7a2d34e634f00545de6
font_01_sfnt_off00011363.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11363 10656 bytes
SHA-256: 042418c5dfe4807cac7e3c4ceba156ab7b3c1f35fc659a772510af68326bb4e6
font_02_sfnt_off000137d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137D3 4324 bytes
SHA-256: 781b9fae2fb9201b4a05d2041fea553bb2973f1d011ab9c51e3326c72e342c60

Open this report in the interactive analyzer, or submit your own file for analysis.