Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ddefb8c2fdeb1fd…

MALICIOUS

PDF

99.7 KB Created: 2021-03-21 22:52:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b69667323ebb8a66febc94bcecbe8227 SHA-1: d5a9cecc4c7c9f61846ea4b81effaaaf8e11864b SHA-256: 7ddefb8c2fdeb1fd19c3734932c819a3debd1288654c486fa79ed057ed8e0cfc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm with numerous external URLs, suggesting an attempt to drive traffic to potentially malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a mass of external PDF links, with the primary malicious URL being https://nipisod.ru/award?keyword=hello+and+goodbye+athol+fugard+pdf. While no scripts were extracted, the structure and embedded URLs point towards a phishing or SEO spam campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=hello+and+goodbye+athol+fugard+pdf
    • https://cdn.sqhk.co/zoboxoba/ibihgVe/57019819261.pdf
    • https://cdn-cms.f-static.net/uploads/4472491/normal_60182ebb786f0.pdf
    • https://cdn.sqhk.co/mogizufofuj/0nHhegd/weather_underground_portland_mi.pdf
    • https://cdn.sqhk.co/leluforeref/iXgiPif/n64_emulator_apk_pro.pdf
    • http://naxiramomamaz.66ghz.com/manual_de_instrues_impressora_hp_laserjet_m1212nf_mfp.pdf
    • https://cdn-cms.f-static.net/uploads/4444856/normal_602b41037c7be.pdf
    • https://cdn.sqhk.co/lebogomatoze/lmhcdnX/american_civil_war_summary_video.pdf
    • https://static.s123-cdn-static.com/uploads/4380083/normal_5fcc0dd56e50f.pdf
    • https://cdn-cms.f-static.net/uploads/4416921/normal_6011e0e05dd0e.pdf
    • https://cdn.sqhk.co/pigajifaw/iejibih/hello_starshine_the_earth_says_hello_song.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vopimivukaf.epizy.com/74351594725.pdf
    • http://disaninoguviko.rf.gd/76000005387.pdf
    • http://musexarobegos.epizy.com/aristoteles_y_dante_descubren_el_universo.pdf
    • https://9abff256-b119-4e75-a612-dfc075f5428e.filesusr.com/ugd/c73517_b3066ba2a9af45fc9d3b4d9c98b7e22b.pdf?index=true
    • https://0298dc5a-7924-4276-8279-06452a5288da.filesusr.com/ugd/b30cf0_df7c100f8fc642729415c261bd9e0d15.pdf?index=true
    • https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_d810e32d3e5b4aebaa02a48ebbf7609b.pdf?index=true
    • http://zasefewesawutam.epizy.com/52485136425.pdf
    • http://manisamat.epizy.com/design_documentation_in_software_engineering.pdf
    • http://takerowul.epizy.com/56905746561.pdf
    • http://moborudazijom.epizy.com/australia_visa_application_form_sample.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001515a.bin
7e0342d5faa01cf6075e81cbc402df9535c4c4ae22c8ab883582e56030c29139		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1515A 26768 bytes
font_00_sfnt_off00011463.bin
8edf0cd4b611a065fc3196b37060e6a8011d2ac1f873dbc8e68df69fb558f379		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11463 5328 bytes
font_01_sfnt_off0001267e.bin
1e9c8d27069420bf2de3d87d1a96cf69f951f5c8ef6521e999ed65d0de2f7eb6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1267E 13424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.