Malicious PDF — malware analysis report

Static analysis result for SHA-256 b668375bd4c77664…

MALICIOUS

PDF

81.3 KB Created: 2021-09-17 22:36:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: bdc2dd6cf7fd77321c767c8f0d99a936 SHA-1: 66b7626c4b2670b3f9fc5596e9e3dd28e094a0c7 SHA-256: b668375bd4c77664198e7f7bcfaaca77971e44f51212a864788475514124ce07
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by an ML classifier as malicious. It contains numerous embedded URLs, with the 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic indicating a pattern of hosting many links on disposable domains. This suggests the document's primary purpose is to redirect users to potentially malicious sites, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://net-marketing.hu/images/files/fapuxu.pdf
    • http://inimtrento.it/userfiles/files/zatet.pdf
    • https://alperbehang.nl/userfiles/file/poxurejawidawuzedab.pdf
    • https://orderpoet.com/ckfinder/userfiles/files/67235007244.pdf
    • https://aakritidigitals.com/userfiles/files/diluxu.pdf
    • https://strechybenesov.cz/content/51543625755.pdf
    • https://bruceautoservice.com/files/file/7582089979.pdf
    • http://tydafa.com/dafa/uploadfiles/20210910134316.pdf
    • http://tauroconsulting.pl/userfiles/file/fosisudabemigufitiw.pdf
    • https://fullmagicweekend.com/ckfinder/userfiles/files/12164783010.pdf
    • http://gallery4walls.com/upload/editer/file/51863707988.pdf
    • http://wamer.org/userfiles/file/7515190117.pdf
    • http://18554080.com/userfiles/file/pilonazobefigesunise.pdf
    • http://edu-family72.ru/content/images/uploads/file/jesezozasilusuxezox.pdf
    • https://vanrun-it.nl/userfiles/files/buzenumixi.pdf
    • http://isagenixmakessense.com/ckfinder/userfiles/files/fizapisuxunuluvow.pdf
    • http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/1613cb410f07f3---garevetupuvikisulonevaf.pdf
    • https://emotionalgift.com/ckfinder/userfiles/files/69477715399.pdf
    • https://hainutedecopii.eu/ckfinder/userfiles/files/lelojixonukiwakevoxod.pdf
    • http://thebodyclubonline.com/userfiles/file/vasobawujex.pdf
    • https://ourcampuswindow.com/ckfinder/userfiles/files/kemegefudosiveradinijum.pdf
    • http://tw-echen.com/uploads/files/202109050436594858.pdf
    • https://tagoproperties.com/ckfinder/userfiles/files/13533943665.pdf
    • https://skillmapmagazine.com/ckfinder/userfiles/files/xejokebemobinemem.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=creating+assets+folder+in+android+studio
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d822.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD822 16792 bytes
font_01_sfnt_off0000f039.bin
20507fa29f1d02c1773303d53e69d6d08747c836452bbfd28bff1bf64abde643		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF039 10660 bytes
font_02_sfnt_off00010893.bin
fae11b4aa12864dea0d4f9182b1f7fe4360af2ddf5d0c41a3995d73a35c3112b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10893 17732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.