Malicious PDF — malware analysis report

Static analysis result for SHA-256 81d7c979740d9308…

MALICIOUS

PDF

67.2 KB Created: 2021-03-11 06:42:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2de78c12221270ad495c6624eedee661 SHA-1: e997a99e888804422fd72c1fd09c8bb1c6c2d0af SHA-256: 81d7c979740d93089dd1d4c919a12dfc3dec6bf61aee30370a46181456fa869d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO spamming operation. The document body, though heavily corrupted, contains text related to 'Arizona neighbor crossword answer key' and 'wkhtmltopdf', indicating a lure to disguise the malicious intent. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple external URLs reinforces the assessment of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=arizona+neighbor+crossword+answer+key
    • https://cdn.sqhk.co/xadakede/i1Fjf3a/70739112305.pdf
    • https://cdn.sqhk.co/vazoguzo/hizggIf/minecraft_live_wallpaper_download.pdf
    • https://cdn.sqhk.co/wimedizi/326Fge4/crew_trainer_application_form.pdf
    • https://static.s123-cdn-static.com/uploads/4460230/normal_60036c4f10a71.pdf
    • https://cdn.sqhk.co/pefevepufi/oAAZihp/foosball_player_3d_print.pdf
    • http://xafalivugala.iblogger.org/64375772096.pdf
    • http://logefekur.22web.org/vebupaxipekifikopunobita.pdf
    • http://nejevefivi.mypressonline.com/67496149127.pdf
    • https://cdn.sqhk.co/vusutazomaga/dhja2he/clash_of_kings_newly_presented_knight_system.pdf
    • https://cdn-cms.f-static.net/uploads/4479707/normal_6021486765e42.pdf
    • https://cdn-cms.f-static.net/uploads/4391001/normal_603b6c9b1502e.pdf
    • http://savuwit.iblogger.org/gozakufaluni.pdf
    • https://cdn.sqhk.co/bupedamarib/ii2jd0Q/76875205079.pdf
    • http://sujimelowakolop.medianewsonline.com/un_puente_hacia_terabithia_espaol_latino.pdf
    • https://cdn.sqhk.co/vozogekom/sswhegh/32481995592.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pedamodaw.onlinewebshop.net/damodarastakam_lyrics_in_kannada.pdf
    • https://f8d82b49-d438-4da2-b906-f876cb6fe635.filesusr.com/ugd/12dc78_5b532c151d1749f59a9b403637bd5266.pdf?index=true
    • https://19972ee8-34f0-4900-8009-9f590161cd02.filesusr.com/ugd/64db51_de45ce2c580045ffb14087e6311c8790.pdf?index=true
    • https://3064a0a7-8496-4b95-be1e-56094aee372f.filesusr.com/ugd/0cf4b9_4093b461acff478fb25dd7ba4ea4d2de.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c92d.bin
0898a0e78af06eb41ae24b059591087cf9161ba34f1a07ce76d7d9fd835b6b9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC92D 5608 bytes
font_01_sfnt_off0000dc4d.bin
5c6f665862c8ecde59c2e4f5ac98528f258c9adeabbe209d3e8c10fb65812bc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC4D 10148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.