Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f9a493931e0f161…

MALICIOUS

PDF

76.7 KB Created: 2021-05-31 15:29:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 534131878b2612686626dab162169c1e SHA-1: 279a23c8b5a80546b098707807158006b6eba471 SHA-256: 9f9a493931e0f1617d6d93bcafa6ecc2b0852b3278688f63c63417486be51827
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a primary malicious URL identified. The ML classifier strongly indicates maliciousness. The document body, though heavily obfuscated, contains text related to 'car parking hack apk', suggesting a lure to a potentially malicious download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=car+parking+hack+apk+4.7+8 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4470207/normal_6067ea464d900.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455898/normal_603073ce00fc0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476007/normal_5ff03f3a85681.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368975/normal_601aea0940b9a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452377/normal_5fe75633b8387.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425507/normal_6039d35592c5a.pdfIn PDF document text
    • https://pelifofenap.weebly.com/uploads/1/3/3/9/133997555/tupikuxaxozuwik.pdfIn PDF document text
    • https://baseparefawufif.weebly.com/uploads/1/3/1/4/131453046/2997860.pdfIn PDF document text
    • https://povarudoro.weebly.com/uploads/1/3/5/3/135324530/noruputakikax.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a01b48d9-f270-422d-a117-a08014bda767/94987803373.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9bb4222f-bb01-42b0-9634-1195fd46255c/deadpool_3_full_movie_in_hindi_dubbed_download_filmyzilla.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5caa9b0b-9c2c-4fae-9b01-b295b87dc946/81900168562.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d09a525-196a-4628-9a34-4b51334bf46c/how_to_get_a_birth_certificate_after_adoption.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ee3ba34-d38e-4159-8124-edcf05ef73c9/ludaxa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7483a926-3082-4dee-b256-f019e61344d1/plato_geometry_mastery_test_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b181bd0-a0b0-4e9f-8e9d-b235e77a3613/48435980018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/43d262b0-321f-4216-a0cc-d316182cf17b/sikipobuzotuvizuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c14ed49-70a5-43b4-a008-2c181db497c9/upward_basketball_coach_application.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ead5eece-fa01-46d3-aa8e-0bcf0c20e474/zizixalajimasowenunena.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/045b2e3b-c348-4839-9daf-dd8a3dc0c510/how_to_write_my_employee_evaluation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27fd042a-3e9f-4bcf-9a8d-f5302672d04d/how_to_draw_a_3d_step_by_step.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED81 5348 bytes
SHA-256: ccbca21872b9eb7b169335e0cf402b2658bfe305d10e5a3a47bdd2a9ece18d5e
font_01_sfnt_off0000ffc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFC2 10540 bytes
SHA-256: 17c79586f878048d4cf0608d87fbaffbc1cb12b4afec0957aecc4c2ea49d6bf4

Open this report in the interactive analyzer, or submit your own file for analysis.