Malicious PDF — malware analysis report

Static analysis result for SHA-256 af9397c3ffa1a4d5…

MALICIOUS

PDF

79.1 KB Created: 2021-04-02 18:49:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 176dbafee4779a438c740cc8b1c777ba SHA-1: 9c74a5d43892339b7bdd5a9a93bec1a1378d1372 SHA-256: af9397c3ffa1a4d500500c7be77fb8c3e5993b7d32a16fa04aae494d8f28d382
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains numerous embedded links, many pointing to disposable domains and redirector infrastructure, indicating a link farm or SEO manipulation tactic. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK and PDF_SEO_LINK_FARM strongly suggest malicious intent. While no scripts were extracted, the presence of embedded URLs and the ML classifier's high confidence score support a malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=los+adjetivos+en+frances+pdf In PDF document text
    • http://ijmalan.xyz/is_a_badger_bite_dangerousa6nfv.pdfIn PDF document text
    • http://svarka-aurora.online/the_fall_camus_explainedu3oqi.pdfIn PDF document text
    • https://rapironid.weebly.com/uploads/1/3/1/3/131398378/vewulomudem.pdfIn PDF document text
    • https://mipurilor.weebly.com/uploads/1/3/1/0/131071035/327925c.pdfIn PDF document text
    • http://13millions-warzone.store/carena_kobbe_lux_manualdgosv.pdfIn PDF document text
    • https://dowusezawidi.weebly.com/uploads/1/3/3/9/133997386/jiximukudiwep_nimubivuwovu_labaxolewaba.pdfIn PDF document text
    • http://ihsteam.ru/game_pc_windows_10_32_bitcnti2.pdfIn PDF document text
    • http://otomail.business/erich_fromm_a_arte_de_amar_frasespry5o.pdfIn PDF document text
    • http://coins24h.com/vosuzubejuxilubga3xj.pdfIn PDF document text
    • http://hookup668.site/how_do_you_tell_if_an_infj_loves_youryv39.pdfIn PDF document text
    • https://nanoxoxudotu.weebly.com/uploads/1/3/0/8/130814682/jipan.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/dc94bbfc-d191-4bd0-88ab-ba12b6acf4eb/91314639760.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8700460d-a574-4ded-a8bd-d367551517e8/what_is_the_dragon_in_neverending_story.pdfIn PDF document text
    • https://d89d6b52-6e76-4e18-bccb-bd7428cfddad.filesusr.com/ugd/02beb7_45078fe8f36b4521ba4ca6aa93869ad2.pdf?index=trueIn PDF document text
    • https://6c473ef0-402e-45f0-9f95-6bc7e89a6a1a.filesusr.com/ugd/5518c3_5f0c93b189ec46da844389b7543155d6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca52f831-f445-41de-a886-353b0e1e31d6/xenogevugavaxo.pdfIn PDF document text
    • https://c7bff75e-0a19-4817-9d47-fca4cf08161b.filesusr.com/ugd/3b6424_446868562a484508afb723abb4cea231.pdf?index=trueIn PDF document text
    • https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_f8f79ca8337f408488c863b7c4fac53c.pdf?index=trueIn PDF document text
    • https://e8f98835-b194-42a5-b43f-fe2f29920dd6.filesusr.com/ugd/bf650e_a32b2d825d6649419c7b2e568cb96c46.pdf?index=trueIn PDF document text
    • https://6b137298-3864-41c5-aaa3-11744000c3c2.filesusr.com/ugd/b916f4_9deb4897b9084292bfc8b1657eccc253.pdf?index=trueIn PDF document text
    • https://0b7b936c-93ac-4a60-9644-6ba220b934cc.filesusr.com/ugd/b4bf80_263eee75d5ca443eb8c5d37d23ab4c29.pdf?index=trueIn PDF document text
    • https://8ed62699-7d02-4439-b935-4286882ef7d4.filesusr.com/ugd/229b11_340b9cbd294b484780991ea588fa272f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d1b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1B9 4980 bytes
SHA-256: 749f8a8aeefd5293b0d7f50c3f33bc348ba9aae68dbfe51e3032d0977e99547c
font_01_sfnt_off0000e2c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2C0 12020 bytes
SHA-256: 4803e76815c0cb1253cbe4a38bdedc1d1c247f41ee62db4b19cbfba41b8c682a
font_02_sfnt_off000109a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109A7 16204 bytes
SHA-256: a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd
font_03_sfnt_off00011ed4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11ED4 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.