Malicious PDF — malware analysis report

Static analysis result for SHA-256 88335853b4ab3c60…

MALICIOUS

PDF

51.1 KB Created: 2020-11-06 02:30:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 4f43ac781a34cc56ff98ad3c83b89304 SHA-1: b924e4577dc074449825673342626cb1ac3d46d3 SHA-256: 88335853b4ab3c60e3b260a1e9832c39829184674b05ccef12f2a6e6c568d71e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that points to a website designed to look like a practice problem answer key. This is a common lure for phishing or to redirect users to download malicious content. The ML classifier strongly indicates maliciousness, and the PDF structure suggests it's part of a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?keyword=chemistry+12-3+practice+problems+answers PDF link annotation
    • https://pumowurunumig.weebly.com/uploads/1/3/2/7/132740285/6b41f5087bb3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365619/normal_5f86fd187bd3a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380699/normal_5f920bb336829.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/d52a857d-9d2d-431d-bf09-ad6cc8ada914/66724711204.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/caf4b736-73ed-4b34-91cc-34749b33215a/ccna_final_exam_answers_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8d31905-2378-443b-afb2-f2d50377bada/matilda_roald_dahl.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f88b495-6d39-461a-8c79-f9cf9ecc7b31/labekesatexolo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b92be724-52f8-4360-a8a8-6ba7539061bd/legend_of_zelda_ocarina_of_time_emul.pdfIn PDF document text
    • https://s3.amazonaws.com/popagexexoza/android_root_app_download_for_pc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7999bd2a-2e08-46f1-bb9d-6fa351f7316b/rulonekifesagojog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/694f4a57-d927-40d5-b047-f86fc14a2c8a/27463720790.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88d5c61d-0ebc-449e-bd0e-66a81fcd70be/54951962949.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e0a3607-2db1-4701-b2b4-26f74697324c/64122266648.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c88cbe4-f5fb-4313-a3f3-9d1ac2730616/ziwejavu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000076e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76E8 5696 bytes
SHA-256: 3e95d1effdd82b8f9b637c3806cf560dfd8388845af5cc4afb9ffa68de216dde
font_01_sfnt_off00008a31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A31 10948 bytes
SHA-256: 41d09b19a439c8fca59064a7eb9be432e205b633911f31f197de6a4135f15ff1
font_02_sfnt_off0000af5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAF5F 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.