Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa9a3b43ef7c4d76…

MALICIOUS

PDF

70.7 KB Created: 2021-06-07 09:38:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f37b99f867c3c2c5f7e3ee462ce04803 SHA-1: 193e23f49d544cbe1f6244d9664961b303f1dae7 SHA-256: aa9a3b43ef7c4d76727e15f5ffaa114b6f1aaf018189df01dbd3346bd79820c5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file exhibits characteristics of a link farm, with a large number of external links, many of which are to other PDF documents. The primary URL, https://laborke.ru/pbw, is associated with a search query for movie downloads, suggesting a lure to potentially malicious content. The ML classifier also flagged this PDF as malicious, reinforcing the suspicious nature of its content and structure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9562

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/pbw?utm_term=new+hollywood+full+movie+download+in+hindi+filmyzilla
    • https://mokapojigum.weebly.com/uploads/1/3/4/6/134690111/tidekun.pdf
    • https://cdn-cms.f-static.net/uploads/4468563/normal_60bc1da88a5f3.pdf
    • https://cdn-cms.f-static.net/uploads/4492253/normal_604f4c9e9ccb6.pdf
    • https://cdn-cms.f-static.net/uploads/4426815/normal_600fccc577524.pdf
    • https://cdn-cms.f-static.net/uploads/4457838/normal_600a4a658cf5a.pdf
    • https://cdn-cms.f-static.net/uploads/4465935/normal_605e105b8452b.pdf
    • https://xevupuwikuguv.weebly.com/uploads/1/3/0/8/130814145/9565c197.pdf
    • https://static.s123-cdn-static.com/uploads/4443588/normal_5ffe9adcc1523.pdf
    • https://bamesejoporafuv.weebly.com/uploads/1/3/4/2/134265360/324300.pdf
    • https://cdn-cms.f-static.net/uploads/4392193/normal_6036da1bc0954.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ziriwuru.pbworks.com/f/nadra_e_sahulat_multan_cantt.pdf
    • https://uploads.strikinglycdn.com/files/6846b965-ac3a-4db4-a855-ee0bbf485be0/zasipapiwive.pdf
    • http://luwivaj.pbworks.com/w/file/fetch/144514590/list_of_non_manual_markers_in_asl.pdf
    • http://bopidix.pbworks.com/f/barbie_peliculas_completas_en_espaol_latino_una_aventura_de_sirenas_1.pdf
    • http://muxapoxowo.pbworks.com/w/file/fetch/144645201/plants_vs_zombies_2_music_jurassic_marsh.pdf
    • https://uploads.strikinglycdn.com/files/bcdab2dc-744b-48ac-bc18-1eef45fd7ff4/performance_kpi_dashboard_excel_template_free_download.pdf
    • http://jolowajuwijo.pbworks.com/w/file/fetch/144591867/z3x_box_pro_36.1_crack.pdf
    • https://uploads.strikinglycdn.com/files/de462da1-7289-44e2-ba05-9f6c94052a22/download_design_home_mod_apk_android_1.pdf
    • https://uploads.strikinglycdn.com/files/91ebf55b-1735-4006-84e3-e468a148f312/6538702937.pdf
    • http://xojifot.pbworks.com/f/organization_theory_and_design_3rd_canadian_edition_free.pdf
    • https://uploads.strikinglycdn.com/files/e3799663-22ee-4e5d-a771-4781b21c882b/99733669639.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3cf.bin
7ad9876d8eb5d047d81209af56d6ef1c0b379390d3c23a772dc5b901ebb2e357
pdf-font-stream PDF embedded font (sfnt) at offset 0xE3CF 5148 bytes
font_01_sfnt_off0000f559.bin
b8bb6844e17537e7b274aecca0da72d2e8b2e483a6103873be343a031ed1cf26
pdf-font-stream PDF embedded font (sfnt) at offset 0xF559 11000 bytes