Malicious PDF — malware analysis report

Static analysis result for SHA-256 686269cf11fc4979…

MALICIOUS

PDF

78.3 KB Created: 2021-03-30 02:11:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eab5664574ba660a222a6021db67d908 SHA-1: 73d272558e1bd5a542e98331df31044d66c4dd81 SHA-256: 686269cf11fc4979bfb8fd167ea13cbfbec691b9cc05d6a06cc903f22995be28
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, many of which point to disposable domains and are part of a link farm designed to redirect users. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically identifies this behavior. The ML classifier also strongly indicated maliciousness. The document body text, though heavily obfuscated, contains a reference to 'lavenders blue dilly dilly sheet music', suggesting a lure for users seeking musical content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=lavenders+blue+dilly+dilly+sheet+music
    • http://tinesemexogo.mygamesonline.org/masterbuilt_30_inch_electric_smoker_lowes.pdf
    • http://tigafik.mygamesonline.org/73749791761.pdf
    • http://kesisofawa.mygamesonline.org/libro_de_historia_universal_contemporanea_pearson.pdf
    • http://rolapisi.scienceontheweb.net/ipad_mini_newest_model_2020.pdf
    • http://fodelogutejamit.getenjoyment.net/nulitubuvukate.pdf
    • http://litesunaju.iblogger.org/3572053457.pdf
    • http://netarowivon.iblogger.org/69389514621.pdf
    • http://xonibiz.22web.org/gawifenezitokuz.pdf
    • http://zorugukuremired.22web.org/samorakefomut.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rigatage.epizy.com/la_bella_e_la_bestia_fiaba_originale.pdf
    • http://katemuzi.rf.gd/integers_and_absolute_value_worksheets.pdf
    • http://firejevewonoba.rf.gd/ews_application_form_download.pdf
    • http://xusavax.epizy.com/67774776069.pdf
    • http://midofel.rf.gd/insignia_headphone_bluetooth_adapter_manual.pdf
    • https://uploads.strikinglycdn.com/files/7c9a761c-e7cc-4e23-8e7e-505cd551b0b1/poliwisipufuv.pdf
    • http://loxezenot.epizy.com/11106210863.pdf
    • http://tikatogivuso.rf.gd/bifexopa.pdf
    • http://wamijak.epizy.com/2010_chevy_camaro_rs_tire_size.pdf
    • http://magajavopisili.epizy.com/school_complaints_procedure_template.pdf
    • https://uploads.strikinglycdn.com/files/905d8e45-d34e-4471-ac49-16cfa63f31f0/tc_renegade_hunter.pdf
    • http://limevevane.epizy.com/77911324612.pdf
    • https://uploads.strikinglycdn.com/files/57b9d57c-d496-4570-96e1-a78518312f7a/el_mundo_feliz_resumen_por_capitulos.pdf
    • http://voxotili.epizy.com/weather_report_chula_vista_california.pdf
    • https://uploads.strikinglycdn.com/files/0236c17d-9a8a-419d-8f07-9f2847b2f369/balancing_chemical_equations_worksheet_middle_school_doc.pdf
    • http://kuxomexepus.epizy.com/detect_font_size_in.pdf
    • https://uploads.strikinglycdn.com/files/973cbc6c-0a0f-4d0f-942c-2a9458a1b399/78287552114.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f372.bin
c9108fe683d3554561ab585cba0ca2019c9e44a6ffce10c93caa2cd6e2ce624d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF372 5420 bytes
font_01_sfnt_off000105bf.bin
df72f9244426961991091c0544eb0b89a6e2dce5154615b83a16d18c92351fa9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105BF 11228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.