Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ed33f48e568f992…

MALICIOUS

PDF

101.8 KB Created: 2021-03-09 10:43:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 23df4336847da1a38042382aa0273561 SHA-1: 6e9c05251be9bc7b50f4d77d5ca0e7775fd6e7f5 SHA-256: 7ed33f48e568f992311c55a6af4a1164da489efaf0b1826f6371e143a0b35106
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are SEO-optimized to appear as legitimate documents, indicating a link farm or SEO spam campaign. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external URIs suggests an attempt to redirect users to potentially harmful content. No scripts were extracted, but the PDF structure itself is used to host and distribute these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=area+and+circumference+of+a+circle+word+problems+worksheet+answers+pdf PDF link annotation
    • http://sy0n.icu/wejewonerezorexiwovimm1aaa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457572/normal_600081f52d993.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489054/normal_5fe9d7f84d996.pdfIn PDF document text
    • http://kinorio5.xyz/briggs_and_stratton_vanguard_18_hp_parts_manualsb0lm.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381971/normal_5fdd2859023cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420752/normal_6020590585b3b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405208/normal_60066f07a16b7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dukexajuj/all_in_one_apk_onhax.pdfIn PDF document text
    • https://50b44c92-959e-4a15-bf83-93d6b2b518d6.filesusr.com/ugd/3ed44c_c806477c7deb4cf5bdc39e4562e32d8f.pdf?index=trueIn PDF document text
    • http://paludibedujeg.epizy.com/rudujadodiwulevir.pdfIn PDF document text
    • http://tigufot.rf.gd/harry_potter_lego_2021_australia.pdfIn PDF document text
    • https://s3.amazonaws.com/jeduzizonox/81082804550.pdfIn PDF document text
    • https://s3.amazonaws.com/tifuwuw/ansible_template_src_relative_path.pdfIn PDF document text
    • https://s3.amazonaws.com/somamere/nurinitusojorozex.pdfIn PDF document text
    • https://eeeff038-21f9-42a6-bde0-cd945221d618.filesusr.com/ugd/9dc459_7429767a20c74b3098c7bdf1197dfec2.pdf?index=trueIn PDF document text
    • http://nonixita.rf.gd/lofevajomesugovogojikutul.pdfIn PDF document text
    • https://s3.amazonaws.com/vikukinumet/20111804796.pdfIn PDF document text
    • https://s3.amazonaws.com/lebejos/zajilasikowek.pdfIn PDF document text
    • https://s3.amazonaws.com/kiremefegonar/anatomical_planes_and_sections_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/jeromisixinolib/replacing_dryer_belt_maytag_performa.pdfIn PDF document text
    • https://e9593579-f51f-4dc6-af55-2543ab512b45.filesusr.com/ugd/37952c_abbdff2b4e2f4f01ae9326504c81f458.pdf?index=trueIn PDF document text
    • https://441768bb-9839-4df4-8f78-dd1233b527f6.filesusr.com/ugd/7e6080_81fa9673f89f4b79862721ad0be1c464.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014468.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14468 2828 bytes
SHA-256: b7f317aa0f29cd34df008dc84d8f376d2685882a57a4a5cd0d86477d0adf885a
font_01_sfnt_off00014e63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E63 5680 bytes
SHA-256: 083601d468003452d8476d7c75f4c1928af610aa32a3eb90229f3acecce748d7
font_02_sfnt_off00016197.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16197 10920 bytes
SHA-256: 41d0a5d15a6ee5081cb4b9d25dc6927bed851b2aad44e4a2bbb2bbb7367a7572

Open this report in the interactive analyzer, or submit your own file for analysis.