Malicious PDF — malware analysis report

Static analysis result for SHA-256 bec9653d731d6458…

MALICIOUS

PDF

99.3 KB Created: 2021-04-23 23:33:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: fb6358b44c774bbba7e34331e7a9a615 SHA-1: 127988c99129cdec64f5fcefb47af32998f039c1 SHA-256: bec9653d731d6458d337ec8689db8d16001c06c95ec73c78b3122d8fa6d6f708
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=1000+most+common+korean+words+with+pronunciation PDF link annotation
    • http://organic100.fun/writing_contests_2020_no_entry_fee9m5l0.pdfIn PDF document text
    • https://kitivagep.weebly.com/uploads/1/3/0/7/130775950/113806.pdfIn PDF document text
    • http://nuromagav.iblogger.org/jajorapufido.pdfIn PDF document text
    • https://bowonalixatan.weebly.com/uploads/1/3/5/3/135347428/86b9df.pdfIn PDF document text
    • http://xitnet.fun/865479870474cfuo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mokijogibosa.epizy.com/tigoke.pdfIn PDF document text
    • http://lumawasisoxo.rf.gd/little_krishna_movie_flute_ringtone.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/45187626052.pdfIn PDF document text
    • http://nupabumafe.epizy.com/molotov_cocktail_piano_sheet_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/248c9ae1-5db3-4868-9595-dd96a59f170c/how_do_you_replace_the_battery_in_a_timex_watch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/366b0a55-5d79-41e6-a03a-653807a0a7d6/vaxavipofu.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/how_to_use_a_small_aroma_rice_cooker.pdfIn PDF document text
    • http://fatafebegit.epizy.com/zojedipojim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90fba821-ad51-4d9e-a5ea-72ab84b183f2/how_to_install_calculator_ribbon_canon_mp11dx.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31d99a29-9f92-42d6-9d27-f251bd6e57a0/how_to_read_motorcycle_wiring_schematic.pdfIn PDF document text
    • http://seluxud.epizy.com/xanafavutopevekofas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd197584-e7c1-46ad-bdae-ed16f4c2c052/verbos_regulares_en_ingles_con_pronunciacion.pdfIn PDF document text
    • http://notewajojop.rf.gd/27751982503.pdfIn PDF document text
    • http://zunedolu.rf.gd/whats_your_passion_quotes.pdfIn PDF document text
    • https://s3.amazonaws.com/xojafemori/barking_dog_video_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000103ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103AD 16224 bytes
SHA-256: 2e81df7eb7835cc14a9fdcb51bc2b7e86fe6160c0f8eaa75d53a9e4cd2da282a
font_01_sfnt_off0001370a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1370A 5536 bytes
SHA-256: ab0746e243f6c626319449d00a662ece3ad7718014734c51291817823855c2d4
font_02_sfnt_off000149bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149BB 1728 bytes
SHA-256: 0810ce0371bb48a6dbbb6c56d423a1e4bda4455f4638deeed9c91ec23a796c96
font_03_sfnt_off00015253.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15253 14752 bytes
SHA-256: 3b8212eddf331a5c5d79beb13e1fa8b290e2956aed79e031cadea73743c6943e

Open this report in the interactive analyzer, or submit your own file for analysis.