Malicious PDF — malware analysis report

Static analysis result for SHA-256 d72808a528153389…

MALICIOUS

PDF

87.8 KB Created: 2021-04-15 00:08:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b86a8306f824425e155178fe4811fae8 SHA-1: 238ab343bd8b83aa2bc1246fbba6338de9dbbc26 SHA-256: d72808a528153389ecc77af923189cc6a62500f71a2862635e94bb07f52718da
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, a common tactic for SEO link farms and to distribute malicious content. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates the document's purpose is to trick users into a fraudulent scheme. While no scripts were directly extracted, the presence of many external URLs suggests a potential for downloading further malicious content or redirecting to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=patterns+for+college+writing+14th+edition+free
    • https://cdn.sqhk.co/kufejeni/9wep2hf/skins_for_minecraft_java_mac.pdf
    • http://nubebukexowi.66ghz.com/al_quran_bangla_uccharon.pdf
    • https://cdn.sqhk.co/romilononove/hhCgc42/8813460040.pdf
    • https://cdn.sqhk.co/jabuvilir/hijfVij/asereje_ringtone_free.pdf
    • https://cdn.sqhk.co/xovepejegosi/zjczQb3/stickman_master_archer_redeem_code.pdf
    • http://aycotoro0.xyz/gasivinimirawumivute2usf6.pdf
    • http://muzoc.xyz/stickman_and_shotgun_3kybvj.pdf
    • https://cdn.sqhk.co/nowavutu/ibchhi0/the_labrant_fam_house_shopping.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2521c3e2-5736-45bb-9381-71005f2ffa37.filesusr.com/ugd/c85705_dfa26080223c4846b975f16c03f34ff8.pdf?index=true
    • https://s3.amazonaws.com/zubuwujoxom/52976385805.pdf
    • http://rofosonovoze.rf.gd/62932324244.pdf
    • https://s3.amazonaws.com/netinuwa/assignment_of_benefits_medicare_form.pdf
    • https://s3.amazonaws.com/gezetega/jefogoxumemepibesapekup.pdf
    • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_c0141d3e80a24a5b8a93b81719f1e0b8.pdf?index=true
    • https://76c9fb28-c10e-4950-85be-37de24a2ede8.filesusr.com/ugd/fa32a6_d7631c61eaf3481f8b52262ad82957be.pdf?index=true
    • https://74df6fe0-557b-4e47-8461-f2df536053d0.filesusr.com/ugd/4dcf4e_1580c6f98c9e435db798d89889d1035f.pdf?index=true
    • https://57ead060-d7b3-4f59-a803-6c9b47c0028a.filesusr.com/ugd/f30481_85bee8ef6d684469920f200056245cb7.pdf?index=true
    • https://6b137298-3864-41c5-aaa3-11744000c3c2.filesusr.com/ugd/b916f4_e2f2fc2c21d0498ca8b51da2878acf2a.pdf?index=true
    • https://c4e42e93-254c-4ba8-b495-737f84002742.filesusr.com/ugd/ddb60a_0f973c046d8c418593f81fbb8aa4a048.pdf?index=true
    • http://dijakobikegexi.epizy.com/zokatinasopowojizu.pdf
    • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_2925365df47d455081028e70915bfa3e.pdf?index=true
    • https://s3.amazonaws.com/fizufapu/98591148184.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd6b.bin
5fccc4b93669808a911be510fa35354615011d06cae0a9a774c0ef2e9a75b465		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6B 2828 bytes
font_01_sfnt_off00010775.bin
644b6faf55ae7b45372c7c2f1f200410ac2cebedf8c06b35fceedafca113b920		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10775 5304 bytes
font_02_sfnt_off00011986.bin
3a1716289bebe0f93754a29b0816fc507a72b0c20e94172f63fa4ce204012ed0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11986 12528 bytes
font_03_sfnt_off000142da.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142DA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.