Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c47dc49feaf562e…

MALICIOUS

PDF

77.3 KB Created: 2021-03-08 12:29:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: ce44b6f9542d76438b6feb25c0854829 SHA-1: 9fc2d67f2c88d44d043e6be04f5a95bad2a141e5 SHA-256: 6c47dc49feaf562e36fcaa21c19226bd62dbef177aacfa18fcb0d66ed83ecbb4
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=rock+band+drums+ps3+used PDF link annotation
    • https://cdn.sqhk.co/javukapegami/ghIqNgC/90908008652.pdfIn PDF document text
    • https://cdn.sqhk.co/juvanejejuwo/bgjvk0V/io_shen_knives_review.pdfIn PDF document text
    • https://cdn.sqhk.co/pumafuki/ge7LU5j/15639271081.pdfIn PDF document text
    • http://tometifo.getenjoyment.net/vujam.pdfIn PDF document text
    • https://cdn.sqhk.co/baluwofuk/Tidiaib/bookworm_word_game_free.pdfIn PDF document text
    • https://cdn.sqhk.co/borefigux/gdWmhjL/wumaluweluxob.pdfIn PDF document text
    • https://cdn.sqhk.co/xeloxilava/bAsjHpd/hang_gliding_uk_prices.pdfIn PDF document text
    • https://cdn.sqhk.co/vekazedivipi/f6o3Y8I/premiere_theaters_cloquet_mn_showtimes.pdfIn PDF document text
    • https://cdn.sqhk.co/xexodaxafu/hgWYigY/high_speed_camera_app_for_android.pdfIn PDF document text
    • https://cdn.sqhk.co/bumajanivosi/je73yTX/84713922670.pdfIn PDF document text
    • https://cdn.sqhk.co/ziriziwebu/icxiagj/75706373991.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e03951e9-093e-494e-b3c9-006095c4424f/49837858902.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22bae6c1-5aeb-4a18-b93a-3cf115d471ee/black_box_g1w_manual.pdfIn PDF document text
    • http://nomamazuzut.atwebpages.com/what_is_the_starting_pay_at_wendys.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9be3f559-3ab9-4872-8937-92013238fabe/35414554670.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b365c9f1-2a20-40c1-a674-2b20b0e96199/42684971562.pdfIn PDF document text
    • https://4c5ad993-366d-4b3a-aa99-9b6f56583180.filesusr.com/ugd/01e791_2da446a62444470ba267ee161512f1a4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/369023ac-df4f-4f29-8b9e-bdec6b29f711/scag_tiger_cat_2_weight.pdfIn PDF document text
    • https://22449060-8e30-4723-8828-967625cce342.filesusr.com/ugd/eddc50_788800cd19474e0aafce50c98379c257.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ec95d87-4b55-4075-a0b2-a45c53f9ddb4/movejimebutosunozo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c094c8b0-42c3-43af-8972-51a5ab1aa63c/derechos_humanos_en_mxico.pdfIn PDF document text
    • http://tivakifuzir.atwebpages.com/dedalu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81cd613e-dbf4-42a3-b2a8-b1b3e0e535b4/1st_grade_diploma_printable_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39473067-86ac-48e3-9da5-d9a766a28633/how_to_cook_chicken_and_rice_in_a_power_cooker.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24dcd370-4db6-4066-ac27-5c8981571966/wagilotubusumuvapopag.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3E 5564 bytes
SHA-256: 0f2d6e3113a7dad7c361c08881ae3094efbcaaa95cf7b18d6077ea75ce5360c0
font_01_sfnt_off00010218.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10218 11112 bytes
SHA-256: 28e5875e94b45166f37f480deff2cfeeaa06ccec29a825cf30ecb92dacbd4854

Open this report in the interactive analyzer, or submit your own file for analysis.