Malicious PDF — malware analysis report

Static analysis result for SHA-256 7905bd2e3eb4455b…

MALICIOUS

PDF

168.3 KB Created: 2021-03-08 15:30:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 390f863aea7e5fe015c7e1c6f9971574 SHA-1: 588d9fca2b0969ccaa7df3a8763752941b301320 SHA-256: 7905bd2e3eb4455bcf07db1e38f068f9eca4954e1868d73223471e25b9e7986e
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=methodology+of+mathematical+economics+and+econometrics+pdf PDF link annotation
    • https://cdn.sqhk.co/lilaxikixo/yidjfW9/criminal_case_lookup_cook_county.pdfIn PDF document text
    • http://pifowovumuwe.medianewsonline.com/5_2_diet_how_long_to_see_results.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489980/normal_603a41048ab22.pdfIn PDF document text
    • http://bifitiguz.iblogger.org/maine_pyar_kiya_movie_mp4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369519/normal_602b335bcec53.pdfIn PDF document text
    • https://cdn.sqhk.co/puroneruk/l6g4gey/32634608290.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401559/normal_600c593865ed1.pdfIn PDF document text
    • https://cdn.sqhk.co/poronujefino/hU9jhhh/bff_cute_halloween_costumes_for_teenage_girl.pdfIn PDF document text
    • http://sowopezamiw.medianewsonline.com/does_arthritis_come_from_cold_weather.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476593/normal_602a1beec7d8c.pdfIn PDF document text
    • https://cdn.sqhk.co/ramazunor/jyhdpgj/zupusu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499283/normal_601d650749ef8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tiwatimab.atwebpages.com/51913289397.pdfIn PDF document text
    • http://zodumuf.rf.gd/1012394012.pdfIn PDF document text
    • https://ac263381-fdad-4fda-ae78-6df6d71032d6.filesusr.com/ugd/25c42e_ddca8a912399418491471af366ae1b62.pdf?index=trueIn PDF document text
    • http://situbepid.epizy.com/51155333900.pdfIn PDF document text
    • http://zilajib.epizy.com/fuporuberakifawi.pdfIn PDF document text
    • http://xovipofeguz.epizy.com/realidades_2_capitulo_1b-_1_answers.pdfIn PDF document text
    • http://tumofif.rf.gd/ziwufitedonuxamuso.pdfIn PDF document text
    • http://jimarol.myartsonline.com/fibekibotapoxikub.pdfIn PDF document text
    • https://0fe83ef2-ed6b-4f04-a52d-31fe3c58d8d1.filesusr.com/ugd/ade4e6_9e5739fe11b545c4b8917c64db3337e2.pdf?index=trueIn PDF document text
    • http://xuxusemo.epizy.com/79575176529.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off000263a2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x263A2 26820 bytes
SHA-256: 27262467b859bec2955bd7d20bca471de131a7bc08359e1bb52faf0fafe0f7f4
font_00_sfnt_off00021351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21351 5676 bytes
SHA-256: 4e01e94f4d4b7cbe5f23f2d11450c73e4ab2e29bb3c4fd63a2e77272399532f9
font_01_sfnt_off0002264b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2264B 6300 bytes
SHA-256: f9040d1db0a4d2c36348b61deedb6452c7b89e1cf098c47e79d7154965611559
font_02_sfnt_off0002359f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2359F 13992 bytes
SHA-256: 4fd7b78523cfc78e08f78f90c7d2fecd48fe36fd5369a28a4c692f376d08aff6

Open this report in the interactive analyzer, or submit your own file for analysis.