Malicious PDF — malware analysis report

Static analysis result for SHA-256 b843d1a253aa002d…

MALICIOUS

PDF

95.3 KB Created: 2021-03-18 15:44:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 30f6d1a6294a22f1dd1734e06bb058df SHA-1: 17eab29aedae50767fee78b4239bd93d67afd7e5 SHA-256: b843d1a253aa002dd6246ebde5cefdc0cf1a8f2339d5a2d831300a045ed68c3c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting it is part of a link farm designed to drive traffic to various websites. The document body, though heavily obfuscated, contains text related to checking PC specs for games, which serves as a lure. No scripts were extracted from this sample, but the presence of numerous external URLs indicates a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=check+pc+specs+for+games
    • http://ruzawiwosaje.iblogger.org/circular_motion_notes_download.pdf
    • https://vogizezadu.weebly.com/uploads/1/3/0/8/130814341/8da228fcdd3bd.pdf
    • https://cdn.sqhk.co/lefuwaregew/cgdhjs8/herbalism_guide_wow_tbc.pdf
    • https://cdn.sqhk.co/buzaxelubot/ichecia/panda_express_store_near_me_now.pdf
    • https://cdn.sqhk.co/lovolipeg/o2Pzrv2/trusting_god_day_by_day_free.pdf
    • http://kagogumo.iblogger.org/a_field_guide_to_lies_critical_thinking_with_statistics_and_the_scientific_method.pdf
    • https://medotufise.weebly.com/uploads/1/3/4/5/134512565/07145ba9160cde4.pdf
    • http://xemizawufogutuf.scienceontheweb.net/46825386024.pdf
    • https://cdn.sqhk.co/rowazazapa/idH5Wjb/vinogunixoruzof.pdf
    • https://cdn.sqhk.co/dozelodet/hh4Lijg/peralawe.pdf
    • http://jonotijero.medianewsonline.com/pilud.pdf
    • https://cdn.sqhk.co/madagijoj/iislmie/benetton_watch_hdfc_offer.pdf
    • https://gizazegixewaner.weebly.com/uploads/1/3/4/5/134596748/gutexelimid.pdf
    • https://limifotediko.weebly.com/uploads/1/3/5/3/135325738/6216b93a.pdf
    • https://juxusuvib.weebly.com/uploads/1/3/0/7/130739690/fotoduvorivofuxures.pdf
    • https://cdn.sqhk.co/letinumi/C6UghlP/69755003365.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bajefeluxit.rf.gd/basic_computer_course_fees_in_delhi.pdf
    • http://mujebik.atwebpages.com/xatopodib.pdf
    • http://vivizegijarugip.epizy.com/power_episode_guide_and_air_dates.pdf
    • http://guwaxilajoxeza.onlinewebshop.net/meligasapexuzemudufev.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecb2.bin
439cff36002774f29c667a858bef3b80cfd042725d8ca77d18958bd30c9435a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECB2 20068 bytes
font_01_sfnt_off00012ba3.bin
a4da27fbc188b99b13ceb714c16b8dc147e9bbad047a3fd61afa5508cf445303		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BA3 5036 bytes
font_02_sfnt_off00013cc4.bin
6a59504f59198acbe11dfcdeb40474adc749a272951aa0428f0b1fc2e98ed9d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CC4 10632 bytes
font_03_sfnt_off00016109.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16109 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.