Malicious PDF — malware analysis report

Static analysis result for SHA-256 b76ca33e2bd98a8b…

MALICIOUS

PDF

79.0 KB Created: 2021-04-06 01:17:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 18a0704744c78a0f27ad83c4f4632054 SHA-1: 533570c12711057cf6351a998813911f89dec79a SHA-256: b76ca33e2bd98a8b3ed346ff6c2f5b9b1287833e81a26d8b05c26c946ce205a0
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=les+types+des+adjuvants+du+b%25C3%25A9ton+pdf PDF link annotation
    • https://fipugodegiposal.weebly.com/uploads/1/3/4/6/134687615/jewaroxugojotab_gafaluzub_bowiluboxipem.pdfIn PDF document text
    • https://vowodilob.weebly.com/uploads/1/3/4/6/134697463/ae4205a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_110cceb6979c46338f72150ff0ac10ca.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/73290a87-12c7-40dc-8753-3ce600c4adab/repavegivi.pdfIn PDF document text
    • https://91e55214-10ad-44cf-a10a-60a9392df58b.filesusr.com/ugd/e1c37d_b3da2d1df43d48d8b448388242202e11.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wefemabeni/filavaveximovuterovinilu.pdfIn PDF document text
    • https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_a1b6800ee55c4e09b87d8a290283de3a.pdf?index=trueIn PDF document text
    • https://436c154b-1c2d-4c60-9768-ed3a268ef5e1.filesusr.com/ugd/e8e253_95e54b2485544c11a0061d435b1af578.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a716f9f3-5935-42d3-a0db-d21b244b917f/types_of_structures_sedimentary_rocks.pdfIn PDF document text
    • https://cef8af8d-7071-4339-ac50-fc417d371010.filesusr.com/ugd/a89196_3f05b42e6a4f4c50a95af37cdde1c2e0.pdf?index=trueIn PDF document text
    • https://299bc67c-4c9a-44ea-852c-18f2d39dca40.filesusr.com/ugd/954c8b_a1602867e90f4b9dbbf0bceae26944bf.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/timeziso/mafoseruranasapudovefado.pdfIn PDF document text
    • https://s3.amazonaws.com/zuniverijesud/why_is_the_short_run_average_cost_curve_u_shaped.pdfIn PDF document text
    • https://s3.amazonaws.com/gomakobez/omron_hem-650_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fc3c09e-45c9-444e-8095-5fe1ff42df6d/casio_ms-80s_set_tax_rate.pdfIn PDF document text
    • https://s3.amazonaws.com/vunizi/spontaneous_generation_vs_biogenesis.pdfIn PDF document text
    • https://s3.amazonaws.com/sepovutapakogaf/30963564030.pdfIn PDF document text
    • https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_901c4e66bdfd48dcbdbf584dc7944df1.pdf?index=trueIn PDF document text
    • https://0ecef3a8-5193-4df1-8dcb-1b7dd0f2be2a.filesusr.com/ugd/e6092c_74d4a7e1d9d741519ab0aebfeb5db00e.pdf?index=trueIn PDF document text
    • https://2e81f42f-67f9-46a9-89e2-a5f3ab3b03ee.filesusr.com/ugd/f138f5_2edd3baff1ec42e7adce594aecbd4978.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0B5 5368 bytes
SHA-256: 15aa8510ae8a89ee0ffa20fc522673b0bda712d3d163a4fb35197ac323923051
font_01_sfnt_off000102dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102DD 13112 bytes
SHA-256: 799623c11b06868fc3e256eeef1abaa7dd36e1617cb31bff5bcb045d107b7d16

Open this report in the interactive analyzer, or submit your own file for analysis.