Malicious PDF — malware analysis report

Static analysis result for SHA-256 abf32dbddd614bf8…

MALICIOUS

PDF

131.6 KB Created: 2021-03-12 09:16:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 1bb6ee1365a396a540d44eb4ef42df6a SHA-1: 13f879662e8635e3fa98a59f8436790b8285e078 SHA-256: abf32dbddd614bf8351932b0a415a910c467ee77e250884d58411fb2d30404b1
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=cognitive+learning+involves+group+of+answer+choices PDF link annotation
    • http://kyhni.site/457679876863anuj.pdfIn PDF document text
    • http://bojalusexob.iblogger.org/notatesorobif.pdfIn PDF document text
    • https://cdn.sqhk.co/jedelamodafa/jjiahav/68980639211.pdfIn PDF document text
    • https://cdn.sqhk.co/kubemuzu/ghepEhb/bts_burn_the_stage_movie_legendado.pdfIn PDF document text
    • https://cdn.sqhk.co/loziromegon/hdight9/playroom_storage_ideas_ikea.pdfIn PDF document text
    • http://copyrighthelpbusiness.net/frankenstein_mary_shelley_justine_moritz_quotesvxfvu.pdfIn PDF document text
    • https://cdn.sqhk.co/zukasedu/hdX95ih/kavogatomija.pdfIn PDF document text
    • https://cdn.sqhk.co/borefigux/bYqjcKW/66664898389.pdfIn PDF document text
    • http://fullstacket.online/dns_server_clash_of_clansox252.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://livivisobozi.rf.gd/how_to_change_time_on_citizen_eco_drive_wr200.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/645fcd7e-103e-4671-999e-c127c013e061/77811134698.pdfIn PDF document text
    • http://wekiwuja.rf.gd/85697323433.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3975dc51-401d-4ab7-a3bc-141c120b5cd4/39307252107.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/247af3c9-b1c9-4579-a02c-2b652167341c/how_many_hours_are_required_to_be_a_journeyman_electrician.pdfIn PDF document text
    • http://lutodize.epizy.com/45927817906.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b438db4-e8a7-43a5-b8a7-982c009df900/87062951301.pdfIn PDF document text
    • http://nuvufitimasex.epizy.com/8d_problem_solving_explained.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38f58489-f389-4b35-b01b-31f84ebe770f/zinetadirugava.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcc675da-3ee6-407f-b5c3-a5f7ea06694d/dewalt_3400_psi_power_washer_hose.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2629ab5-a4fc-4e2d-a70a-3be328fdfa51/is_game_of_thrones_books_over.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3eb0cf23-f419-46a1-aaeb-b460c36f70f1/79969412263.pdfIn PDF document text
    • http://risatimax.rf.gd/angry_neighbor_nullzerep.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001b780.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B780 5336 bytes
SHA-256: 8ea75ff29e0bbd3cafe4c4c9de034e4b84623b44f198b4e489e3841f091584aa
font_01_sfnt_off0001c9c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C9C6 12016 bytes
SHA-256: 0a61feed6535fe7da9b5febd539ed56ff0b179bbc55ca68111e37e7d0bea8ca6
font_02_sfnt_off0001f18c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F18C 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.