Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cdb595336a6cf5f…

MALICIOUS

PDF

81.5 KB Created: 2021-03-13 17:29:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e40b29487daa8c619bc34f2ae380b0f1 SHA-1: 943a545a2b8b154304a87f313ad6659ac70040f4 SHA-256: 8cdb595336a6cf5f49516331e820911c612c4f1bb49a9ef813cddf45b471cf09
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting an attempt to drive traffic to a network of websites. The embedded URLs, such as 'https://xezojetit.ru/wix?keyword=how+to+use+titan+gel+sinhala', indicate a potential SEO spam or phishing lure. While no scripts were explicitly extracted, the PDF structure and the ML classifier's high confidence score point towards malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=how+to+use+titan+gel+sinhala
    • https://pekonupag.weebly.com/uploads/1/3/2/7/132741447/2553626.pdf
    • https://tiriwubesunadew.weebly.com/uploads/1/3/0/7/130739346/9723726.pdf
    • http://nebatomefov.scienceontheweb.net/93225188315.pdf
    • https://static.s123-cdn-static.com/uploads/4384154/normal_5fe0e197c0b33.pdf
    • https://meluwirukumipi.weebly.com/uploads/1/3/1/4/131483006/forudese.pdf
    • https://nilemesobipefuj.weebly.com/uploads/1/3/2/3/132303022/sexiriwa.pdf
    • http://gaximivotekole.mypressonline.com/parabonesatexumemu.pdf
    • http://xasumemazekejo.scienceontheweb.net/poratigopudipisitikagajok.pdf
    • http://kefudepoduwudi.sportsontheweb.net/techniques_d_amlioration_continue_en_production.pdf
    • https://dezijetide.weebly.com/uploads/1/3/4/8/134864221/sulike.pdf
    • http://nepatokada.mypressonline.com/heat_exchanger_for_wood_burner.pdf
    • https://static.s123-cdn-static.com/uploads/4446494/normal_5ff7aa812abf3.pdf
    • http://bumasujofoj.getenjoyment.net/siwuxujububazaribaraketoz.pdf
    • http://kijofizovurisos.medianewsonline.com/3529598191.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://velefaluzi.epizy.com/card_sorting_exercise_information_architecture.pdf
    • http://vobozezojip.onlinewebshop.net/jenn_air_range_parts_knobs.pdf
    • https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_c4bb987f640c4098bcfbd69c52a6009b.pdf?index=true
    • https://3485775d-af35-4505-8fb4-f6750f575e04.filesusr.com/ugd/42f18e_8ebf08b0939942f9a0053a6a28f87909.pdf?index=true
    • http://nogurinuzelajer.rf.gd/20716300095.pdf
    • https://da54c32a-99c7-4590-8520-800dd2d1cae3.filesusr.com/ugd/7973d2_bef68cd83daa47409f6ba4b90b0eecfd.pdf?index=true
    • http://gasolawatovi.rf.gd/4148641575.pdf
    • https://b1d4f555-1eac-4d61-aa83-27206cf3ee4b.filesusr.com/ugd/1706f5_bd9cb9fefe7e4763a0f51c1109674b3e.pdf?index=true
    • http://motagetezo.epizy.com/what_do_u_mean_by_daring.pdf
    • http://femumakowaw.epizy.com/wonusar.pdf
    • http://pajupevezujugut.atwebpages.com/fuzukoxub.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2db.bin
4a58b3412c8f758510c0184e9b19349f93dfbe49588ab36f094ad3b5706b796d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2DB 4904 bytes
font_01_sfnt_off0000e35b.bin
1e61a39b5383f35663cb39f3542c8c4c82ac3cd72a4599fd1b739389321c1d41		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE35B 18716 bytes
font_02_sfnt_off00011456.bin
204e1246391639c218c513c24d9fd61e04eda1d4352972f1a86469db9e780c5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11456 10332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.