Malicious PDF — malware analysis report

Static analysis result for SHA-256 7edf0abc82d45658…

MALICIOUS

PDF

75.7 KB Created: 2021-03-24 15:14:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e1b36b4591fa004de0b61ed947a02189 SHA-1: b3c1f08d3e861e763d4e6f597852dff0e6949fd5 SHA-256: 7edf0abc82d456582e4542615865d762b218cf540f2ed9f13114e882b84d8676
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which point to PDF files hosted on various domains, suggesting a link farm or SEO spam operation. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, indicating it was likely generated programmatically. The presence of numerous external URIs and the ML classifier's high confidence score support the assessment of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=the+city+and+the+city+bbc+season+2
    • http://bumasujofoj.getenjoyment.net/34523448994.pdf
    • https://cdn.sqhk.co/tutabalero/FLErgeG/21349610085.pdf
    • http://fevofawemuwa.medianewsonline.com/list_of_all_abstract_nouns_in_english.pdf
    • https://cdn.sqhk.co/xopuxuvop/hjieEUq/stick_fight_online_free_download.pdf
    • https://cdn.sqhk.co/tatonabufule/hhkTgj0/noviform_gonsalva_katt.pdf
    • http://xivazokib.medianewsonline.com/change_to_word_adobe.pdf
    • https://cdn.sqhk.co/jopubelo/uMidOjh/dipovubiturapu.pdf
    • http://fejekadiwoxobiz.getenjoyment.net/modern_physics_class_11.pdf
    • https://cdn.sqhk.co/jorisuzil/eibGigM/tufavobojepotojenib.pdf
    • https://cdn.sqhk.co/nilimijano/ZRjxZhj/learn_html5_and_css3_from_zero.pdf
    • https://cdn.sqhk.co/vapitinab/fVORiXE/79434275274.pdf
    • http://minesaxofunawi.getenjoyment.net/77376804799.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://37dcb74a-b492-4e6c-94d7-6984b04a3d7f.filesusr.com/ugd/01eaca_8c0b25f05eec473988ca0dd7d064162e.pdf?index=true
    • https://s3.amazonaws.com/ratixifo/game_ps2_untuk_android_tanpa_emulator.pdf
    • https://77ac2d45-d533-4b4b-a85c-01e81860bff9.filesusr.com/ugd/7f1ad7_1abe28ce0c1e47a9b165688fec12f302.pdf?index=true
    • https://441dbedc-201a-49d7-bb2a-292980023e2b.filesusr.com/ugd/473728_c7879d7b7f824925aa07b7be077fa73e.pdf?index=true
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_9251c40648b448749e3ba0df456185b6.pdf?index=true
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_d546b41a7ab44e599d9dd7ec4ef3838f.pdf?index=true
    • https://0879403c-3be5-48e4-925f-21334a7d5cfe.filesusr.com/ugd/407fcc_ad850033d1834ef2bed59bfe2a5a74e5.pdf?index=true
    • https://s3.amazonaws.com/zizene/vimudenosulaze.pdf
    • https://2a082fd4-e93f-4b8e-9e59-408fa046b31c.filesusr.com/ugd/e334dd_697384aaa9a14a8bb989f0c0206c4c9f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eac6.bin
ee309f4568d7b2e1828ed1629edb7602da352b525bbff20e4e0522ca28361366		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAC6 5224 bytes
font_01_sfnt_off0000fc8b.bin
ff7671d3b842b6bbe8d80c9e2eba688472055efcd35a8f579564013a0f50b383		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC8B 10868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.