Malicious PDF — malware analysis report

Static analysis result for SHA-256 8faa207d54c9c092…

MALICIOUS

PDF

73.6 KB Created: 2021-05-06 02:12:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b4acf0fd6c0fe8fb893ce28f879cb475 SHA-1: 7bbb57b3273326b0e9671a75bb35677b4bf8c92f SHA-256: 8faa207d54c9c092dbbc26df8c9c5e81b3d7b9695f9da3b21e95db54856d1f85
96 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which point to SEO-optimized PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, suggesting a malicious intent to direct traffic or host further malicious content. While no scripts were directly extracted, the PDF structure and embedded URLs are indicative of a malicious document, likely delivered via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=graco+duetsoothe+swing+%252B+rocker+sapphire
    • http://mudopuxez.22web.org/pisosevopuwom.pdf
    • https://cdn.sqhk.co/kubepugemaki/oMcP6gc/822697767.pdf
    • https://cdn.sqhk.co/jojikoxazew/ghii0SW/gedipiwasonagodagujujo.pdf
    • https://cdn.sqhk.co/sategexarom/hjhmyhg/71522887911.pdf
    • https://cdn.sqhk.co/lawafopugu/hePpgde/real_car_parking_2_download_play_store.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nekepozime.epizy.com/bissell_cleanview_bagless_vacuum_filter.pdf
    • https://uploads.strikinglycdn.com/files/6c98cb03-c004-4f2d-8f57-efd0f205d89b/41584346596.pdf
    • https://uploads.strikinglycdn.com/files/bf1d4320-013e-4100-b80f-2df17e5f3546/what_is_economics_definition_in_urdu.pdf
    • http://vovugezufined.epizy.com/kasonumat.pdf
    • https://uploads.strikinglycdn.com/files/c71276e8-0343-40e6-8778-710ea86dd41f/99631714342.pdf
    • https://uploads.strikinglycdn.com/files/9d548c8d-2fae-4e65-9f7b-77adef356347/kurofori.pdf
    • https://uploads.strikinglycdn.com/files/f4c34108-8934-4b24-817a-6a44b9c71844/37573900668.pdf
    • https://uploads.strikinglycdn.com/files/5bbe9c50-07db-4e76-8335-43b135418212/where_can_i_exchange_soda_stream_cannisters.pdf
    • https://uploads.strikinglycdn.com/files/c4709f68-07d0-4be3-85c6-d64aa09ce363/42911483866.pdf
    • https://9d349da1-218b-4b59-9e37-2a90cab56d40.filesusr.com/ugd/de9003_3c9a0db9f9c543bd9cc1e1c43c18bf64.pdf?index=true
    • http://fufinekudag.epizy.com/candy_camera_apk_hd.pdf
    • https://uploads.strikinglycdn.com/files/5ae8ded0-9d03-440b-a392-22534b2730a4/49561630576.pdf
    • https://uploads.strikinglycdn.com/files/282866cd-3742-4b08-b5bc-53e60c4af072/blue_iris_flowers_hinsdale_il.pdf
    • https://26577e91-18e8-42c3-8e85-49dcca1d6605.filesusr.com/ugd/195787_4e7d232ea41f44c4969d480a946f3055.pdf?index=true
    • https://60ceb029-6f78-4d42-8ea4-15ca08d8077a.filesusr.com/ugd/857e61_9f988305dfc84fc7b0f55f67611f7fb4.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e24e.bin
b05d14bcc0964d5768610f4e517d237fda2bd0280c578bbf433c1c4c6dded823		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE24E 5492 bytes
font_01_sfnt_off0000f50c.bin
2c9bbb180b31cc1f9d82b090ec717b537af7a8ef658bf567b0b16bdf6b8a3761		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF50C 10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.