Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcb5468c77f30a0f…

MALICIOUS

PDF

95.3 KB Created: 2021-03-21 02:57:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9738526b4231e6002ce5672aa58523a8 SHA-1: 564e86fa3534f8aa2382ae484eab005b207c5fdf SHA-256: bcb5468c77f30a0f1fcae97c2a2c61e436249860c29f4bb90849754b2be8a34b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files. One of these links, https://midufefew.ru/award?keyword=differential+calculus+and+its+applications+pdf, is flagged as an external URI. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates maliciousness. While no scripts were directly extracted, the structure suggests a link farm designed to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=differential+calculus+and+its+applications+pdf
    • https://cdn-cms.f-static.net/uploads/4476765/normal_6025f999364b3.pdf
    • https://static.s123-cdn-static.com/uploads/4417418/normal_5fde4af4331bb.pdf
    • https://solekavugixe.weebly.com/uploads/1/3/3/9/133999951/058c804aa1cd8d3.pdf
    • https://static.s123-cdn-static.com/uploads/4470967/normal_5fde282ff33cb.pdf
    • https://cdn-cms.f-static.net/uploads/4475389/normal_603b4cc7ab559.pdf
    • https://xiforamuti.weebly.com/uploads/1/3/4/6/134611992/mekadibirakoweda.pdf
    • https://tipowunukal.weebly.com/uploads/1/3/4/3/134355136/relamotorug-levokika.pdf
    • http://womumonafip.22web.org/minna_no_nihongo_n4_mondai_answers.pdf
    • http://xiwogukonefem.iblogger.org/62260313550.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wororeba.epizy.com/roland_spd_sx_stand_price.pdf
    • https://32cf4326-ba62-484c-a3ca-05d02c2dd2e5.filesusr.com/ugd/0b46e6_4538ef0982614cc8bc548789968a52d0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c6d5a9a4-943f-4d4e-9f42-1ffebaa84918/keurig_b31_not_dispensing_water.pdf
    • https://uploads.strikinglycdn.com/files/773e54cc-790f-4711-9241-52c6820389da/boromamalarol.pdf
    • https://uploads.strikinglycdn.com/files/3c1235a8-4ecf-4470-bc17-754f503cf3c1/pujuputefof.pdf
    • https://52f9d6e5-2fd5-4906-a030-4d12f703b62a.filesusr.com/ugd/297ecd_a4d0b0ce9f954355b0f5e479d1913082.pdf?index=true
    • http://wanedinak.epizy.com/carbene_formation_reaction.pdf
    • https://6f672a44-e16c-4921-a0f1-e3781c0647c5.filesusr.com/ugd/bda22a_baa94c30ec864694bb3b3ca0e8d39e99.pdf?index=true
    • https://49550882-97ce-44db-a38b-6e383bb81149.filesusr.com/ugd/062c90_9b0a785d43674ac2a3e6fa9f4ce8759f.pdf?index=true
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_6cd7e57f86604654af81dbf60e2ea838.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0a03bf1e-7d80-48de-8064-5d5e0e311137/whirlpool_microwave_wmh53520cs-6.pdf
    • https://1a441fb4-51dd-4528-a053-eb59ff664e18.filesusr.com/ugd/43d9d5_8b9754a91e6e4660a7d32e77810dbabb.pdf?index=true
    • http://wetusadesaxoni.rf.gd/mofamevupekamebonib.pdf
    • https://2e21b658-2967-4279-8f18-a03590b678a5.filesusr.com/ugd/f5e1b2_4d680a58eb744c3f9e22bfe6f49f9b6e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d22.bin
1abd6e006781ed2e8829d1e408f78e75a492760011379600c38f1a3f05fccdc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D22 5148 bytes
font_01_sfnt_off00012eba.bin
d1c73d5d47e399360019a6fe385f19c141211e4f933d8ff3aab3abfa8a2d768d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EBA 13136 bytes
font_02_sfnt_off000159ca.bin
e5f04cf438ae270923b9be8696c6b85d857a635c0df2b27f5a2b40d17d3d9aa3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x159CA 16232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.