Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d4fb36cb9529e9a…

MALICIOUS

PDF

73.0 KB Created: 2021-03-31 17:53:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eff6c88ce4b098261885bae2f3f198bf SHA-1: 5794b41c02b4b71e5377f3ae122a2518435e442a SHA-256: 9d4fb36cb9529e9a0fc79420620547338ed3d40c3a6259d075ebeed94c57b93d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, a common tactic for SEO link farms and potentially malicious redirection. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs suggests an attempt to drive traffic to potentially harmful sites. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=digestive+system+multiple+choice+test+pdf
    • http://huseyincanx.com/votodezononifozapewux3yx5.pdf
    • https://cdn.sqhk.co/firumefetev/gGid2W5/sand_dig_balls_this_water_table_uk.pdf
    • https://cdn.sqhk.co/fezifenax/ZojcpFj/jaragoxerugominu.pdf
    • http://zarabatyivat.ru/25343777334s1gih.pdf
    • https://cdn.sqhk.co/tulotunofuz/jahhjcX/36051628866.pdf
    • https://cdn.sqhk.co/gunobawiwax/hiejgdY/recorder_notes_with_letters_for_jingle_bells.pdf
    • http://alexandreablog.com/dusudonibupex1cl.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_f9a229c3611440078b8bc63b3a077a45.pdf?index=true
    • https://uploads.strikinglycdn.com/files/98e547ac-7be2-410a-ab54-f04cc44b8b06/93660643508.pdf
    • https://uploads.strikinglycdn.com/files/0c76b06c-9997-40b7-a97b-852c324e55d2/actualizar_firmware_router_d-link_dir-615.pdf
    • https://uploads.strikinglycdn.com/files/bf842582-669d-4456-8dbb-0308b9b0cc08/how_to_use_excel_formulas_and_functions.pdf
    • https://c5b3e1fc-3b55-407d-a8d9-2bfa6c9015c1.filesusr.com/ugd/6df244_f6ef53ef3eb14f8ca19aee243b751603.pdf?index=true
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_4305a174a2d345d88f70e60fa920d759.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ebc02031-f370-49b0-95e5-6cdadd47c760/gusudajibuzefonawowuje.pdf
    • https://b73db3ac-2e3c-475a-83ab-7f4668f00a8f.filesusr.com/ugd/80e8fa_8c382f21934d42f5938931487468dfa1.pdf?index=true
    • https://s3.amazonaws.com/wavunot/how_to_use_qumi_projector_without_remote.pdf
    • https://uploads.strikinglycdn.com/files/cb5091b4-9deb-49f0-ac1c-81099c3333cc/focusrite_scarlett_18i8_2nd_manual.pdf
    • https://ad858f6a-7bbb-416d-9365-e04d7986ed9b.filesusr.com/ugd/3c9ac1_34f288701eaa4af7bec06a46b1c7bdab.pdf?index=true
    • https://f98f40d2-b649-4e6b-99af-b89bbf2331ff.filesusr.com/ugd/724bd4_51b869c131024b2c9ad67d8dd3754e47.pdf?index=true
    • https://459fb65c-52af-4c88-885a-43a44fbeaf25.filesusr.com/ugd/6a7407_62c5afbfffe6479badad49e1a656e80e.pdf?index=true
    • https://88749095-6fd7-453f-8e8a-15b48fe47dd1.filesusr.com/ugd/e4d7df_fd6f909db80f4cfa9c961355f484c323.pdf?index=true
    • https://s3.amazonaws.com/jafujasiwetid/kenneth_cole_watch_bands_brown.pdf
    • https://55d63786-14d6-44de-84d0-33f1fb383c44.filesusr.com/ugd/45fd81_c7613c3230c748a3bac82c24cf31355a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000defa.bin
99d1003e5277c3dd9856c5d0a83e89b810680183817d2ae040249a09dad95ded		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEFA 5424 bytes
font_01_sfnt_off0000f166.bin
d8e43c1dfdd0232867d42a4947390117e33584a451bec62b9f7cc5bec4e8a7a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF166 10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.