Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdffe4c8cf707729…

MALICIOUS

PDF

72.5 KB Created: 2021-04-01 11:51:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 095a6c0251fad8ffc68ed74bc5e31aeb SHA-1: 37d343d506c90fbff952037cc5464b415684c63c SHA-256: bdffe4c8cf7077291ad2da4e027566bf272277fba37f9d9568cc823e7211095f
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous embedded URLs, many of which point to disposable hosting and are flagged as a link farm. The ML classifier strongly indicates maliciousness. The document body, though heavily obfuscated, appears to be a lure related to a product manual, designed to encourage users to click on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=polk+audio+model+psw10+manual PDF link annotation
    • http://rostov-mobile-doctor.ru/8406688330138fy6.pdfIn PDF document text
    • http://fifukeluforonis.22web.org/sakubekepomopumon.pdfIn PDF document text
    • http://maykistore.ru/polaroid_tablet_password_recovery19bxf.pdfIn PDF document text
    • http://naxiramomamaz.66ghz.com/electronics_projects_list.pdfIn PDF document text
    • http://itnegozio.info/tojupugun3qs49.pdfIn PDF document text
    • https://cdn.sqhk.co/wojinagimepu/Hib7fdv/43910423542.pdfIn PDF document text
    • https://wedabivugexum.weebly.com/uploads/1/3/0/9/130968949/keget.pdfIn PDF document text
    • https://fefajuvojamunuj.weebly.com/uploads/1/3/4/7/134750085/2923076.pdfIn PDF document text
    • https://cdn.sqhk.co/zepipawetopi/VifUibO/personal_safety_devices_for_seniors.pdfIn PDF document text
    • http://andyhongdigital.com/betway_apk_latest_versioncqjky.pdfIn PDF document text
    • https://vuxupiwiruxip.weebly.com/uploads/1/3/0/9/130969000/88258f6f4d4f490.pdfIn PDF document text
    • http://tamigome.scienceontheweb.net/65878094538.pdfIn PDF document text
    • http://lolabarafusiru.iblogger.org/wepodevorukeko.pdfIn PDF document text
    • https://xazefobilizap.weebly.com/uploads/1/3/1/3/131384081/bifuxikosog.pdfIn PDF document text
    • http://wogamilip.iblogger.org/totedosewotujiluzuf.pdfIn PDF document text
    • https://cdn.sqhk.co/nelufebo/1hjEEgn/marist_college_ashgrove_uniform_shop_2019.pdfIn PDF document text
    • http://nupifijaw.getenjoyment.net/dekedudasifutolafomojukaz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kasaxamaburabuz.epizy.com/triangle_congruence_theorem_worksheet.pdfIn PDF document text
    • https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_35de30e9763a47f8ac1f26f8df146083.pdf?index=trueIn PDF document text
    • https://46d16763-6c5f-4e19-aa2c-3f4071fcbec2.filesusr.com/ugd/26f730_a56f3ba2187b4944ba330cebfcaa6aa8.pdf?index=trueIn PDF document text
    • http://kewevagisugimuw.onlinewebshop.net/10078930612.pdfIn PDF document text
    • https://7054f9d6-44ea-4b6c-8535-0d04e7cb9957.filesusr.com/ugd/963b03_7ae4dc5811754bfaa895e56a014b5241.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ddc0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDC0 5360 bytes
SHA-256: 3ad9492fd1cb0ba544fcfb55b0cf7fa569fe51593677e7dbdea496bc2c8db401
font_01_sfnt_off0000f004.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF004 11520 bytes
SHA-256: d34b4f9ff9e8992b952b22b10fceafe72a4acf432ae2abbad4985573bcd2bae4

Open this report in the interactive analyzer, or submit your own file for analysis.