Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdbce5cd98e1c31e…

MALICIOUS

PDF

99.2 KB Created: 2021-05-14 10:07:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d7264ac1d2f9dc6b22c5a41915ddb4e6 SHA-1: a90e673f1a517e9201226e4b88fd36a14bce325f SHA-256: bdbce5cd98e1c31e4f958e3ffff3b2c2cb2afe542252bd038094e07b172a3629
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are hosted on disposable domains, suggesting a link farm or SEO spam campaign. The primary lure appears to be related to chainsaw maintenance, directing users to potentially malicious or unwanted content. While no scripts were explicitly extracted, the PDF structure and extensive link farm indicate a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+adjust+idle+speed+on+husqvarna+chainsaw
    • https://wodiwige.weebly.com/uploads/1/3/5/3/135317556/sowipiwofetazevivevu.pdf
    • https://poxigupi.weebly.com/uploads/1/3/1/3/131398264/1585328.pdf
    • http://dadevizevarek.scienceontheweb.net/riwamaxa.pdf
    • https://funudenor.weebly.com/uploads/1/3/4/3/134319253/xikebigumawafu-dumesawe-xomike-vuzev.pdf
    • http://ehaberdevlet.com/tyrants_tomb_release_date_uk36v3h.pdf
    • https://xedafiwiwez.weebly.com/uploads/1/3/2/3/132302754/6ddff2a6a863f2e.pdf
    • http://rostov-mobile-doctor.ru/fujelovanakexorepeqyhu4.pdf
    • http://zememor.sportsontheweb.net/83626238599.pdf
    • http://freehookup.xyz/the_maze_runner_full_movie_free_dailymotionip49u.pdf
    • http://betmoy54.com/18151881799bot6.pdf
    • http://kufafukedexepix.mygamesonline.org/1244177675.pdf
    • https://ferofetilusef.weebly.com/uploads/1/3/5/3/135346026/661eefd83f.pdf
    • http://lnstagramverificationbadge.com/what_happened_with_marbury_vs_madisonb0vg5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://32cf4326-ba62-484c-a3ca-05d02c2dd2e5.filesusr.com/ugd/0b46e6_c5f3572a63274452991fe9ad3806d89c.pdf?index=true
    • https://s3.amazonaws.com/mefadedosuw/niwufutixofilasuxor.pdf
    • http://rabelame.atwebpages.com/gojoxararukanogejuneli.pdf
    • https://s3.amazonaws.com/vetamedisoz/to_kill_a_mockingbird_study_guide_questions_and_answers_chapters_26-31.pdf
    • https://5d3a357a-25b2-4459-9cd8-210b235f7b36.filesusr.com/ugd/45e30f_70fd109b085145cdbb9d316ff1203ce7.pdf?index=true
    • http://tuparibuju.atwebpages.com/defajafu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000139a7.bin
911941ed7db7b07e3184a7c925ec1920c92bbb0ad9d67106080faffdb3b94c79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x139A7 5356 bytes
font_01_sfnt_off00014be8.bin
5681677473c1ec9669159a903d31fbfe98bb4b4d1f0d8655e2af03556d7119ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BE8 11016 bytes
font_02_sfnt_off0001714c.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1714C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.