Malicious PDF — malware analysis report

Static analysis result for SHA-256 863d54dd41b03b71…

MALICIOUS

PDF

78.8 KB Created: 2021-04-30 09:12:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 81e505cc00010f9586ae361ce081074a SHA-1: 1af3831aed24be9de84fff950ae21a34dfa97259 SHA-256: 863d54dd41b03b71dbce85fbe2821da717a37c29431b37eca84af2d2f9c53b16
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=how+to+read+music+notes+for+clarinet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4448724/normal_6014809d94fe5.pdfIn PDF document text
    • http://themarkuzmusic.com/wefarewzj3e.pdfIn PDF document text
    • https://zubosevofugojat.weebly.com/uploads/1/3/4/3/134307347/jonavigupa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465908/normal_5fe7ccc31edc4.pdfIn PDF document text
    • https://cdn.sqhk.co/jojipimuve/hgwhfig/basis_synonym_formal.pdfIn PDF document text
    • https://cdn.sqhk.co/butuxolevu/11ieaFd/ice_cream_truck_for_sale_craigslist_chicago.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424027/normal_5fe72c0882b0f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453334/normal_5fecf8eb8d3ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463298/normal_604ff2977a889.pdfIn PDF document text
    • http://winfreeiphone.xyz/37874547373u2cdf.pdfIn PDF document text
    • https://nezubarenegutel.weebly.com/uploads/1/3/0/7/130776328/mapud.pdfIn PDF document text
    • http://funseeds.site/vejakonebolaumyz0.pdfIn PDF document text
    • http://sy0n.icu/bawawadobatiaauew.pdfIn PDF document text
    • https://cdn.sqhk.co/xawenano/cMhdibG/84581116018.pdfIn PDF document text
    • https://rimuzomidaz.weebly.com/uploads/1/3/4/3/134353295/2c3524a095c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_91ab4243546948d292bf2e65f72c8330.pdf?index=trueIn PDF document text
    • https://75e6d08a-b14f-4c2c-bd4e-3e6431d9d11c.filesusr.com/ugd/497a87_b216be9451e342da982060cdf5edb8ee.pdf?index=trueIn PDF document text
    • https://387a498e-9551-4239-9507-3183ba214552.filesusr.com/ugd/cd403b_b64531b7b2a2421bac43891e4f8c35d4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf34c6f3-4819-4585-a608-a0d6c5ea3cd2/introduction_to_calculus_online_course.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3104e6d-7e2d-4c71-841f-0b8b79393837/is_after_we_collided_on_netflix_in_the_uk.pdfIn PDF document text
    • https://bb209e34-24c3-4901-88bd-c00af8cda710.filesusr.com/ugd/de6798_14dcc05b8b07497c8e474897f62d37c2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f521.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF521 5220 bytes
SHA-256: 81dd54f0c2a529a231cb4a6f912fcf236794e7ee5e46e6e28eb24e5995a15485
font_01_sfnt_off000106dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106DC 11596 bytes
SHA-256: 530a791ecff69432d01e43f8d7f0b474365c240de46b31f03b4e38d329c0ae28

Open this report in the interactive analyzer, or submit your own file for analysis.