Malicious PDF — malware analysis report

Static analysis result for SHA-256 c67a387831979305…

MALICIOUS

PDF

81.0 KB Created: 2021-03-15 06:49:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: edb96df723a51d5cca41c677bbe5695c SHA-1: 100b0f1e493be2da836ed40aee89e7aa02aa1c64 SHA-256: c67a387831979305e8a661794e33ec9b1306076577d1ca486c55d536c07599c4
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=eclipse+dark+theme PDF link annotation
    • https://sikowegapewabi.weebly.com/uploads/1/3/5/9/135975971/fefupolijejanogamude.pdfIn PDF document text
    • https://pixipemojawipe.weebly.com/uploads/1/3/4/4/134459682/c78a9967.pdfIn PDF document text
    • http://checkmyscore.info/cromer_pier_fishing_reportrhi6l.pdfIn PDF document text
    • http://vsspb.ru/el_arte_de_la_seduccion_robert_greene_audiolibro4ngcx.pdfIn PDF document text
    • http://reweder.site/answer_to_what_s_up_in_spanishr1re7.pdfIn PDF document text
    • http://mif-smeh.space/top_10_spoken_english_app_for_androiday7ds.pdfIn PDF document text
    • https://revoninutilira.weebly.com/uploads/1/3/5/3/135338282/ganapur.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fc96d6e-a695-4ddf-8cae-de5e1e11b9c1/zuxuxowamuzanisovudamofo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2125f5ec-1523-4da4-9245-12a797e1f493/national_dolphin_rv_owners_manual.pdfIn PDF document text
    • https://8ac5c8e1-9174-427d-95c2-90bebb9f105a.filesusr.com/ugd/44b221_112e66dd823c41dab7d6fc2f5bc0b108.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/820d908f-7006-43d9-9fd3-23e0e015a746/lajopabubaluriga.pdfIn PDF document text
    • https://de99c131-68bf-4271-bcef-cda292486844.filesusr.com/ugd/f5892c_936c04a587114342b9f2c4b8ddd4dce5.pdf?index=trueIn PDF document text
    • https://03df18d0-0a94-4077-8b44-1f3cf8b7c870.filesusr.com/ugd/23a6c3_75da7e67eed9465cb1afad081aba4257.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c03a3fd-33a0-4e9a-bfa9-7c673bb61a6c/81843814505.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/907253da-3442-48ee-873f-24d23a2d5ca9/luxigutedof.pdfIn PDF document text
    • https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_4b3e47d184654bffa76fd67ad031afe0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e503386-d2b4-46d6-b90c-94cb4d11a249/verudunubazosole.pdfIn PDF document text
    • https://b9e1b105-38e0-4bbf-baad-90de1e2021e1.filesusr.com/ugd/432b07_9d28cab57c3140a8bd31859b0f835139.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/45a685c8-9de7-4ba9-bd52-e04c5f06765a/margin_of_safety_accounting_concept.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d0b60e5-c800-4b7a-a140-89b6fccb236e/15917401655.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30100d77-a2a8-481e-8400-23f62502b7a6/how_to_thread_needle_brother_sewing_machine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bbdec38b-4963-4921-a5d1-7923d017cd6d/tutorial_de_sonar_platinum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f06c95c-09ab-4759-b28c-edc442929edd/90404890980.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B5 5336 bytes
SHA-256: 68c43dbbf6fbcdd2014e3afd4b521dac7e52269c7246392069626bca8cd56294
font_01_sfnt_off000105a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105A5 1800 bytes
SHA-256: daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e
font_02_sfnt_off00010e33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E33 11316 bytes
SHA-256: e938225c42e2ec6f77957d47249d67d987347407f738730257e0d28867832180