Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfa010599be6c649…

MALICIOUS

PDF

103.3 KB Created: 2021-03-13 22:31:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: f7e44ef2f31f114adfa2af7b0854d3b9 SHA-1: 60ccd589d0069babb46f884c5249197ebbf52a79 SHA-256: cfa010599be6c64975d49521f6af5f0090acb3bfcd75695f48d16abd51019f21
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a high number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. Many of these links point to suspicious domains and appear to be part of a link farm, suggesting an attempt to drive traffic to potentially malicious sites or for SEO manipulation. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=been+here+all+along+pdf PDF link annotation
    • http://xtina.online/winosudopitbdp6f.pdfIn PDF document text
    • http://sunepoxuvigos.66ghz.com/bazar_for_pc.pdfIn PDF document text
    • http://zasijeg.iblogger.org/muxenakoravuvin.pdfIn PDF document text
    • http://busivel.xyz/x_nullcline_calculatorblc8c.pdfIn PDF document text
    • http://smm-target.ru/36183359014b2mrp.pdfIn PDF document text
    • http://watercart.ru/111644179443xrlr.pdfIn PDF document text
    • http://dutov.org/abraham_maslow_self_actualizationur54k.pdfIn PDF document text
    • http://parkji5x.xyz/start_your_own_podcast_on_itunesrq6tb.pdfIn PDF document text
    • http://presente-top.store/the_hunger_games_2014_full_movie_in_hindi_dubbed_download_720pj7x5x.pdfIn PDF document text
    • http://2020coupons.info/tazedebowulim8pqex.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://bea00909-aa88-4d38-ac88-e56db460b486.filesusr.com/ugd/923104_4e878f451af44a09a485d091303d3b19.pdf?index=trueIn PDF document text
    • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_271528a0793244738aa8b8be2eac9d07.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xufujofaleki/nomuzikoro.pdfIn PDF document text
    • https://s3.amazonaws.com/gateme/nawevowusirodupatav.pdfIn PDF document text
    • https://s3.amazonaws.com/jonora/the_adventures_of_huckleberry_finn_summary_chapter_17.pdfIn PDF document text
    • https://s3.amazonaws.com/zodawanuror/86862150573.pdfIn PDF document text
    • https://s3.amazonaws.com/wisuw/aaruthra_video_songs.pdfIn PDF document text
    • https://db6d201d-bdff-4648-9982-d9cfaac7639e.filesusr.com/ugd/98857b_df2f5dad3037412bb1964946a60796a3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/medaliwifufugel/answer_key_nts_2019.pdfIn PDF document text
    • http://rinifujojutot.epizy.com/zexuwozerisowoge.pdfIn PDF document text
    • https://s3.amazonaws.com/solonebosop/bideri.pdfIn PDF document text
    • https://s3.amazonaws.com/zopenave/aws_certified_cloud_practitioner_guide.pdfIn PDF document text
    • http://talaxevavilur.rf.gd/bowufesizokobij.pdfIn PDF document text
    • http://dunixojojulif.epizy.com/bukuloketutabololuwivob.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fba8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBA8 22336 bytes
SHA-256: 17ec5282028dbf6e641cb5ef7bd42ab7a3de0ea05dba41e287ac766374f8e899
font_01_sfnt_off000141b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x141B9 5176 bytes
SHA-256: eba40d54f7553ed10b57046dd2b5aa80c279302ffd31fc46475c648aa614721f
font_02_sfnt_off00015353.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15353 10812 bytes
SHA-256: ced6bdd105cc5567b4e46ef4aac5a068ab844e964809b275275d09e2f51eeace
font_03_sfnt_off00017872.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17872 16068 bytes
SHA-256: 2e6efdb6ec6b06881b73571a6dc11127da1b4fc0f11d045bd7c2e12cbfc92ea6

Open this report in the interactive analyzer, or submit your own file for analysis.