Malicious PDF — malware analysis report

Static analysis result for SHA-256 734993ef5c93ae73…

MALICIOUS

PDF

71.5 KB Created: 2021-05-02 00:26:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 89e15a8ac207a1861ee62e0132e24377 SHA-1: 2869ce5126573d199a0c2eb5720039f516e4ad1b SHA-256: 734993ef5c93ae731946752ff9f8c617e97ba1cf9ae23c335413d51785d95496
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1105 Ingress Tool Transfer

The ML classifier and PDF heuristics strongly indicate maliciousness. The document contains numerous embedded URLs, with one specifically identified as a link farm on disposable hosting, suggesting an attempt to redirect users to malicious content. The presence of a URL with a 'utm_term' parameter implies a tracking or campaign-specific lure, likely to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=nkjv+super+giant+print+bible+thumb+index PDF link annotation
    • http://tertov.xyz/verbos_irregulares_en_ingles_en_pasado_simple_y_presente_simple60vkf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449789/normal_602f737f36b72.pdfIn PDF document text
    • http://qwertyujg.xyz/87338535620nvn9u.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413007/normal_603954616ab95.pdfIn PDF document text
    • http://dmgameplan.com/belofebebisewanovevugaslh1hr.pdfIn PDF document text
    • http://figejewumoposes.getenjoyment.net/59168271648.pdfIn PDF document text
    • http://lorewipa.scienceontheweb.net/77375487611.pdfIn PDF document text
    • http://xemizawufogutuf.scienceontheweb.net/behind_closed_doors_episode_165.pdfIn PDF document text
    • http://kawafopi.mygamesonline.org/frankenstein_graphic_novel.pdfIn PDF document text
    • http://musomojil.mywebcommunity.org/asturias_isaac_albeniz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370077/normal_6006e0704228c.pdfIn PDF document text
    • http://sopugepibimel.mypressonline.com/2006_bmw_330i_valve_cover_torque_specs.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421474/normal_5fe74b65742f0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xobeminal.atwebpages.com/accounts_payable_audit_procedures.pdfIn PDF document text
    • https://s3.amazonaws.com/nawosineromigi/invoice_audit_template.pdfIn PDF document text
    • https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_93031750344f4d1fbe17938374cd13d8.pdf?index=trueIn PDF document text
    • https://667b589a-70dd-4c78-a03f-47f6e9f07b1f.filesusr.com/ugd/db80c5_a562799adaef4dcfaa647ed471113800.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/liwafo/does_red_light_therapy_work_for_skin_tightening.pdfIn PDF document text
    • http://rosajeku.myartsonline.com/42177691560.pdfIn PDF document text
    • https://48b7024d-7414-4593-b44d-ed892b96ad15.filesusr.com/ugd/3e5db3_8227f4a101b840fe8aeafae40971e908.pdf?index=trueIn PDF document text
    • https://fb413987-6e77-4bf1-aaa6-e97eb550fbee.filesusr.com/ugd/108936_3e4df3ca4cb84ccf81307f663e73ccf0.pdf?index=trueIn PDF document text
    • https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_ee684a65d7e3402baf807564931b8d26.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lumixi/51995192998.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d77b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD77B 5752 bytes
SHA-256: 7ead9be1dff4abc63f403f1ccbfcae4b771dd3af71c34255f761c2d8ed4e9dba
font_01_sfnt_off0000eaee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAEE 10868 bytes
SHA-256: af771afec73031effcb40a2ca0f0b7a961caecf0ba2c5fd133cdcc64402511b8

Open this report in the interactive analyzer, or submit your own file for analysis.