Malicious PDF — malware analysis report

Static analysis result for SHA-256 59ce7a4a206ed3e5…

MALICIOUS

PDF

73.2 KB Created: 2021-03-20 20:33:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 94efaf22228e99b84e036a8759ea9059 SHA-1: f7a7ed5fd7b8c4ade3a38e65ea975c4e0d2b17de SHA-256: 59ce7a4a206ed3e54f1eaa67676f6eb5b55d3f41e51e63f03bab1a6dbc6a28df
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many pointing to disposable domains, suggesting a link farm or SEO abuse tactic. The 'ML_NYX_PDF_MALICIOUS' heuristic and the presence of multiple external URIs strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to Cisco hardware installation guides, aiming to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=cisco+nexus+9300-+ex+hardware+installation+guide PDF link annotation
    • https://cdn.sqhk.co/zofukumane/ajbzXji/86217596386.pdfIn PDF document text
    • http://meetchat.space/286529509531k32i.pdfIn PDF document text
    • https://vetigepar.weebly.com/uploads/1/3/5/9/135989985/3267422.pdfIn PDF document text
    • https://lodikesilir.weebly.com/uploads/1/3/4/8/134868057/devutobizorewul-dugovo-silibokemisunen.pdfIn PDF document text
    • https://mijonezogiju.weebly.com/uploads/1/3/4/3/134308960/2039236.pdfIn PDF document text
    • https://cdn.sqhk.co/manuguwe/jihIjcj/tukalimunenuwikoneku.pdfIn PDF document text
    • https://taborufizuxedo.weebly.com/uploads/1/3/5/4/135400835/xugigixelokumuvi.pdfIn PDF document text
    • https://diwejixa.weebly.com/uploads/1/3/4/6/134629966/3690055.pdfIn PDF document text
    • https://cdn.sqhk.co/vozaxodep/iiaxjbY/pamilonufiki.pdfIn PDF document text
    • https://jinunezig.weebly.com/uploads/1/3/4/3/134308797/267e1.pdfIn PDF document text
    • https://puwawegolawibot.weebly.com/uploads/1/3/2/6/132682739/gunemuleri.pdfIn PDF document text
    • http://insta-sale.site/753736135150r0kz.pdfIn PDF document text
    • https://xifilovevovo.weebly.com/uploads/1/3/5/3/135346251/sefowodiwol_noxov_venilem.pdfIn PDF document text
    • https://cdn.sqhk.co/nozedimasav/XD2JDhb/democracy_is_more_accountable_form_of_government.pdfIn PDF document text
    • https://rubebukani.weebly.com/uploads/1/3/0/7/130740450/linujigorutudeviju.pdfIn PDF document text
    • https://mekasirizi.weebly.com/uploads/1/3/5/3/135325166/8253874.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/68d17d89-3f3d-4578-8e99-41931ccde033/83293698963.pdfIn PDF document text
    • https://45dcde1a-aed5-4138-b95e-a0f768a283bf.filesusr.com/ugd/89441e_bc2be822a5ab4e229d3056a6345b5419.pdf?index=trueIn PDF document text
    • https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_829f0ad099ac47bf8bc6257abe9c3ed7.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0e4c842-9238-42f7-bf85-176452e0aed9/para_que_sirve_el_te_de_manzanilla_miel_y_jengibre.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5cad02a-5b90-40c5-b207-e6c63ed52f8f/ruzuretigusodumunefelon.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC5A 5760 bytes
SHA-256: 1763fed0337a796f58becc41c060fe807df7d5b1712124ab3be18f708dcb8ac2
font_01_sfnt_off0000f007.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF007 11320 bytes
SHA-256: f819b66807f80ac508caac0c5654f79fc7ec2c3d289de23b69117e6a8a769495

Open this report in the interactive analyzer, or submit your own file for analysis.