Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1450966061c73bb…

MALICIOUS

PDF

82.3 KB Created: 2021-03-12 09:36:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 8d03649c4152d435c50cf42db3f5b80e SHA-1: dfa1672ce22abbf27598c7189892160811633ba3 SHA-256: a1450966061c73bb3e043383da6f5b89bae96246838eb901ebbb90cf2ab6e6c9
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=army+apft+standards+chart+pdf PDF link annotation
    • http://psychologyrelax.xyz/download_farm_invasion_usa_mod_apk3afuv.pdfIn PDF document text
    • https://xevulesej.weebly.com/uploads/1/3/0/8/130874496/zalulorovudixun_febiguwi_jatoriwaterasun_nuradimoguzup.pdfIn PDF document text
    • https://cdn.sqhk.co/rikopekela/chcgdnp/78261122865.pdfIn PDF document text
    • http://pearhaidhr.fun/pizosemigodimewisoe7c28.pdfIn PDF document text
    • https://cdn.sqhk.co/pabelewexo/gegfjgT/zitimuxeki.pdfIn PDF document text
    • https://cdn.sqhk.co/pifizumux/ic6cgcb/city_sightseeing_berlin_map.pdfIn PDF document text
    • https://sesesisemiv.weebly.com/uploads/1/3/4/7/134746737/gepisadu.pdfIn PDF document text
    • https://dopozigixojak.weebly.com/uploads/1/3/4/5/134509916/e21c94be05df.pdfIn PDF document text
    • https://gulapekojikag.weebly.com/uploads/1/3/2/7/132741551/ditiwa.pdfIn PDF document text
    • https://kipusisuvosa.weebly.com/uploads/1/3/1/4/131406826/jutixofu-fobidalo-josineme.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fonaxipovun.epizy.com/57903514445.pdfIn PDF document text
    • http://buzatagijekoj.rf.gd/sky_sports_1_hd_tv_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a71bd758-d1b3-4ebc-9cda-1ec9e021723f/neguruv.pdfIn PDF document text
    • https://s3.amazonaws.com/vogubivajavofu/erlang_calculator_excel_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76f6b9b0-e812-4a0a-89e4-fd6f9d1ec3f4/black_and_decker_weed_wacker_spool_cap.pdfIn PDF document text
    • http://xujekapowizi.epizy.com/dujobi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1d6e0e4-4447-48b1-9b02-6c9e4dafa78f/karcher_k2_owners_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/bejideba/vutefefejefejibibutubanuv.pdfIn PDF document text
    • http://fuvovadujono.rf.gd/41744898555.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC54 5456 bytes
SHA-256: 7773e9331505d0fb5115d38d32e47efb6fe801dbf63d20ef66fe82d7d42de6bb
font_01_sfnt_off00010ec2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EC2 14588 bytes
SHA-256: f2e2d5013488ab4be0fe32e356f41ae39fb4b9f3cf4cfa6622bc6c402beae819

Open this report in the interactive analyzer, or submit your own file for analysis.