Malicious PDF — malware analysis report

Static analysis result for SHA-256 8951ada18e6abf17…

MALICIOUS

PDF

81.6 KB Created: 2021-04-14 15:40:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: c3f42d8c9ebfe10026222940524d159a SHA-1: 9a100573a1cd398fdf7fe709ef95509f11e5f573 SHA-256: 8951ada18e6abf170e6f311186258dee45ee24f252da8d75338d769ffb96d492
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a 'PDF_SEO_LINK_FARM', indicating it hosts numerous external links. One of these links, 'https://pelibifir.ru/strik?utm_term=psycho+robert+bloch+movie', is presented in a way that suggests a deceptive lure. The document body, though heavily obfuscated, contains metadata related to PDF generation, and the presence of embedded URLs and a high ML classifier score further support malicious intent. The primary attack pattern involves directing users to a network of potentially malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=psycho+robert+bloch+movie PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4426815/normal_5fda2ed5d7f26.pdfIn PDF document text
    • http://sneakerspapa.store/inorganic_chemistry_books_for_mscksrit.pdfIn PDF document text
    • https://cdn.sqhk.co/seseniluvus/Sfjehdb/ninja_rope_course_near_me.pdfIn PDF document text
    • http://idealslimitaly.site/leer_el_libro_la_culpa_es_de_la_vaca_para_mujeresnyosp.pdfIn PDF document text
    • https://cdn.sqhk.co/dexasubu/ogjicwZ/8682287438.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451929/normal_5fef8dae12106.pdfIn PDF document text
    • http://buyervannakupitvsem.xyz/my_bloody_life_as_a_latin_kingh6qgt.pdfIn PDF document text
    • https://cdn.sqhk.co/zubixola/u1Ljfji/70461408467.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409797/normal_5fff163530410.pdfIn PDF document text
    • http://7lessons.space/7065278838o2g7m.pdfIn PDF document text
    • https://cdn.sqhk.co/fexonawizoz/YMnINfp/31493199691.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476010/normal_60049cdb2d253.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/kelukakeb/veferulofigowizimodol.pdfIn PDF document text
    • https://s3.amazonaws.com/piradi/how_to_clean_honeywell_humidifier_hcm-890.pdfIn PDF document text
    • https://s3.amazonaws.com/nisiwanolom/gulivijiresimelopen.pdfIn PDF document text
    • https://a49aa754-465e-4bbd-924e-b3d0e7b66bd4.filesusr.com/ugd/81d6a4_403a7a5f2e3541ed839433a7f0a173bb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/donake/setll_reade_in_free_format_rpgle.pdfIn PDF document text
    • https://s3.amazonaws.com/neporezofov/56204863038.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/gains_from_trade_video_worksheet_answers.pdfIn PDF document text
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_1eec24a5eac24fb8923403b02b25801d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/block_site_notifications_chrome_android.pdfIn PDF document text
    • https://52a72965-a6d2-471e-b66a-59a59a4d663b.filesusr.com/ugd/e643da_87073adb95a94835963eb3c74c42c8dc.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f333.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF333 4816 bytes
SHA-256: 06c0229ffba94c9680474f98be17b167b06d097819a7a137a2649109cdf912b6
font_01_sfnt_off00010397.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10397 11540 bytes
SHA-256: 91b7550e2bdcfd9e34d39f8f2c95a9404a139c7bc60f5d89fb33a8780e858fa9
font_02_sfnt_off000129da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x129DA 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.