Malicious PDF — malware analysis report

Static analysis result for SHA-256 b4ab4df2ec476aa2…

MALICIOUS

PDF

81.8 KB Created: 2021-03-10 18:54:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 084e1a20396b445d0b0644f35b1d6f32 SHA-1: ca042c5f84000285662cb8d395b43d27140220c6 SHA-256: b4ab4df2ec476aa2636f2cd3351cfec6750c0dfb1281aa3a83a6cdbbfd3cd2cb
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF document contains numerous embedded URLs, many of which point to disposable domains and are likely part of a link farm designed to obscure the ultimate destination. The ML classifier strongly indicates maliciousness, and the presence of external URIs suggests an attempt to redirect the user to a potentially harmful site. The document body, though heavily obfuscated, appears to be a lure related to product parts, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/aws?utm_term=poulan+p3314+parts+canada PDF link annotation
    • http://nonoxutiwi.mypressonline.com/seresudupiwupupazusosuwi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390057/normal_5fdcb841307c4.pdfIn PDF document text
    • https://cdn.sqhk.co/buwaxaxodi/Rih0Shb/fold_up_wagon_costco.pdfIn PDF document text
    • http://murimubijejaba.mygamesonline.org/material_safety_data_sheet_example.pdfIn PDF document text
    • http://pixidilivutep.medianewsonline.com/76287048911.pdfIn PDF document text
    • https://cdn.sqhk.co/satijumok/egfuhiD/zufudarog.pdfIn PDF document text
    • https://cdn.sqhk.co/peruvereraba/W2jfLBG/34___2019.pdfIn PDF document text
    • https://cdn.sqhk.co/vurikede/hbQ3agc/talking_friends_apps_android.pdfIn PDF document text
    • http://gekodejevotug.medianewsonline.com/89562300922.pdfIn PDF document text
    • http://pejokepi.mywebcommunity.org/62738647249.pdfIn PDF document text
    • http://wuroguredogir.getenjoyment.net/calculus_6th_edition_by_swokowski_download.pdfIn PDF document text
    • http://pegijegur.mygamesonline.org/childs_play_2_tamil_dubbed_movie_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384484/normal_6040b665d3d33.pdfIn PDF document text
    • http://sokixatov.mywebcommunity.org/23315702327.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476270/normal_5fd64da674ee4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482869/normal_5ff523e6ca9c8.pdfIn PDF document text
    • https://cdn.sqhk.co/karopepagu/ilPZGgi/85755080332.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384036/normal_602a9a3734ef3.pdfIn PDF document text
    • http://dosijefa.mypressonline.com/best_shows_on_epix_2020.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/dffffd8b-ba26-471b-ae30-c3484add6311/65632483890.pdfIn PDF document text
    • https://s3.amazonaws.com/jevedijadiki/zezojitotuzi.pdfIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/hadoop_for_dummies_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/083aab6d-176b-46ad-853d-cf244f4ce608/47913065707.pdfIn PDF document text
    • http://pivimufe.atwebpages.com/59145548398.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c599a8e-3b68-4c1e-952b-ce7848659b0b/what_does_enthalpy_mean_in_spanish.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8ED 5372 bytes
SHA-256: b6b312abac6c9944da81a58e0073841df9ee26c47f25fcc3250f1796a1008fe6
font_01_sfnt_off00010b49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B49 14444 bytes
SHA-256: 6dc8a8f952268df3c92d51dcd67273689aa3ab71fe9aae836e19ceacc506da80

Open this report in the interactive analyzer, or submit your own file for analysis.