Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ab0d51d1294fac4…

MALICIOUS

PDF

79.3 KB Created: 2021-05-31 08:08:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 199da67abb4c0c501ae2e0abf0e524b9 SHA-1: 79e809131b00adba2c3fab910cc12080cf51d662 SHA-256: 8ab0d51d1294fac4ede40e77ec8f31ebb3792876a87ac28efdb9fb8afad0e6b1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier as malicious and contains a large number of external links, suggesting a link farm or SEO manipulation tactic. While no scripts were directly extracted, the presence of numerous external PDF links indicates a potential attempt to redirect users to malicious content or phishing sites. The file's purpose appears to be to distribute a large number of links to other PDF documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/4369783/normal_601da667e8923.pdf
    • https://roxadiruxezagu.weebly.com/uploads/1/3/7/5/137514248/sopulawakim.pdf
    • https://vogitoroxubas.weebly.com/uploads/1/3/0/7/130739894/8335738.pdf
    • https://cdn-cms.f-static.net/uploads/4406771/normal_602d818e2ff93.pdf
    • https://cdn-cms.f-static.net/uploads/4496391/normal_606dd03f63356.pdf
    • https://zufakuka.weebly.com/uploads/1/3/4/3/134343409/xevetugawekefi.pdf
    • https://jurizimobijagi.weebly.com/uploads/1/3/0/8/130874317/lividotadizugoxo.pdf
    • https://cdn-cms.f-static.net/uploads/4408471/normal_606e311a3d2c6.pdf
    • https://cdn-cms.f-static.net/uploads/4414868/normal_60115d6203e31.pdf
    • https://kujufilobi.weebly.com/uploads/1/3/1/4/131482850/4074460.pdf
    • https://static.s123-cdn-static.com/uploads/4373987/normal_5ff282f16b533.pdf
    • https://cdn-cms.f-static.net/uploads/4388824/normal_603ea9977817e.pdf
    • https://sazulolako.weebly.com/uploads/1/3/1/4/131453808/vogazejuxa.pdf
    • https://gijogolip.weebly.com/uploads/1/3/4/7/134755622/valupe.pdf
    • https://static.s123-cdn-static.com/uploads/4496582/normal_5ffbb3b0cdf74.pdf
    • https://revapukas.weebly.com/uploads/1/3/5/3/135323612/wugul.pdf
    • https://nuwudune.weebly.com/uploads/1/3/4/3/134362296/8837276.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://feedproxy.google.com/~r/wb/ENAH/~3/_7yJ53orglQ/wb?keyword=o%20manifesto%20comunista%20de%20marx%20e%20engels
    • https://uploads.strikinglycdn.com/files/d6ced8d7-1bb3-4d45-813a-53734c6cc878/79838671980.pdf
    • https://uploads.strikinglycdn.com/files/1fd425a6-305e-4c86-bb16-8133dfcc5cce/98549969912.pdf
    • https://uploads.strikinglycdn.com/files/e7a0fb45-4a12-4025-89f8-205781ea1011/48424896799.pdf
    • https://uploads.strikinglycdn.com/files/47e8daeb-4980-4250-b122-fb4d173060a6/94236141950.pdf
    • https://uploads.strikinglycdn.com/files/79b5075a-d457-4591-aad1-4c56f7250d66/putubatobopofigose.pdf
    • https://uploads.strikinglycdn.com/files/385aa2ed-5ac2-4432-8994-7e5e02f703fd/idylis_air_purifier_iap-10-200_filters.pdf
    • https://uploads.strikinglycdn.com/files/760921ea-f364-4fda-b45c-052085a3cd1d/jevurekevewuridi.pdf
    • https://uploads.strikinglycdn.com/files/1d84c782-50c1-4f20-bb98-0dabbb56df4f/62739121939.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f41d.bin
e0df6ffed10f08a2a898b4078fa00820fe22ff4f44a315fa880ef371a72e1e2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF41D 5436 bytes
font_01_sfnt_off00010683.bin
e02e30d9b62456a46a4ee5bee5090f2f4723be83b66cef1ec81534a13c168969		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10683 13284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.