Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a1fce6197102c22…

MALICIOUS

PDF

83.9 KB Created: 2021-04-02 21:20:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: fd08c2f70d4ea16529064623ee2ce39f SHA-1: 57c619e3a0a719d1d63b509cb3a9fc735326fa3e SHA-256: 9a1fce6197102c2212e3d174cb8f1d0720eaf5677f7cb744b47a316088385aeb
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=does+sharper+image+ultimate+fat+freezer+work PDF link annotation
    • https://gulurevipad.weebly.com/uploads/1/3/5/3/135349864/195325.pdfIn PDF document text
    • http://fijexojor.getenjoyment.net/geronimo_stilton_books_list_with_pictures.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451225/normal_602178ec9830d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376612/normal_603ce0897509c.pdfIn PDF document text
    • https://novomegaweg.weebly.com/uploads/1/3/4/7/134738931/xubaso-tisidizasixuk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443824/normal_604f78985557c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451355/normal_6061e68dd9f61.pdfIn PDF document text
    • https://kuribigewisowe.weebly.com/uploads/1/3/4/6/134688213/4927967.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374372/normal_600493ded75ea.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4493545/normal_5ffe6fa81bdcb.pdfIn PDF document text
    • http://lufexaxoxak.mygamesonline.org/is_omega_good_for_weight_loss.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461202/normal_605b13fd2e962.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459166/normal_6015c2ac3cad0.pdfIn PDF document text
    • http://viwoxufegoger.sportsontheweb.net/amsterdam_tram_map.pdfIn PDF document text
    • http://sufulilutidake.mypressonline.com/raxiraki.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/45f10587-e299-4823-997c-745516e8f9e0/89548320449.pdfIn PDF document text
    • https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_a3c5ad91b06842028d5d9b61b9240f0b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed62e075-f710-45d3-9935-dc15a419241c/would_you_rather_game_questions_funny.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c11e2527-01a5-4af3-885d-ee2a2b1fd751/how_much_fuel_does_a_diesel_heater_use.pdfIn PDF document text
    • https://8b62b971-d575-4461-ae89-9de7a2afac08.filesusr.com/ugd/c5a911_24e727fc60184cb587402f9a7dc781e2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3e974b8-9298-4e46-9941-cdd4bf18aa99/toro_power_max_824_oe_service_manual.pdfIn PDF document text
    • https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_bc961680170b483a93a1023f558f3d29.pdf?index=trueIn PDF document text
    • https://6d0c6d30-55b9-4b7f-8145-34d11b484ddf.filesusr.com/ugd/8db56d_0f196e9c2eeb44daae74f4c08997e8ec.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/01102f5f-8503-4bb8-9217-a7f484a65e0d/39985604384.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010555.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10555 5520 bytes
SHA-256: 06a13a869e84ec4deb4d379841b5496cb825b4f1b9b7f616621b28486e249e2b
font_01_sfnt_off00011812.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11812 11784 bytes
SHA-256: d9739175019c1b9494a3afcc3d617784ed41241755c24372c41e8b3e25970434

Open this report in the interactive analyzer, or submit your own file for analysis.