Malicious PDF — malware analysis report

Static analysis result for SHA-256 e18f4fc226085500…

MALICIOUS

PDF

88.4 KB Created: 2021-04-06 19:58:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: d92d2763ae43bd83b675c77d362afe01 SHA-1: 6ecb9a12240c41f8df6fb3a53f9e026e9a3cf05f SHA-256: e18f4fc2260855001aadac9c31a758aa48176c1c34292958c855b198e8a35243
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier strongly indicated maliciousness, and the PDF contains numerous external URIs, many hosted on disposable domains, suggesting a link farm designed to redirect users. The presence of 'Android tv comprar media markt' in the document body, combined with the PDF_SEO_DISPOSABLE_LINK_FARM heuristic, indicates a lure to a potentially malicious website. No scripts were extracted, but the structure suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=android+tv+comprar+media+markt PDF link annotation
    • https://cdn.sqhk.co/gabironero/idjgchj/one_button_soccer.pdfIn PDF document text
    • https://cdn.sqhk.co/dikizumi/iqhbBTg/war_of_conquest_canada.pdfIn PDF document text
    • http://eroganoficial.site/xiguvimelazanedemumuk1pdx6.pdfIn PDF document text
    • http://closemaze.com/simon_ielts_video_freet90is.pdfIn PDF document text
    • http://penafur.scienceontheweb.net/assam_university_result_2020.pdfIn PDF document text
    • http://bcipreactivaperu.com/79764059912vg6lu.pdfIn PDF document text
    • https://cdn.sqhk.co/tajugajobib/hinOkhg/crash_team_racing_ps4_trophies.pdfIn PDF document text
    • https://cdn.sqhk.co/mavixuwaloz/fjaTTVk/jigomufozikefewewatewufan.pdfIn PDF document text
    • http://topcreditmonitoring.info/879247760733tys.pdfIn PDF document text
    • http://rozogididibusar.sportsontheweb.net/cunto_tiempo_puede_durar_un_zumbido_en_el_odo.pdfIn PDF document text
    • http://naturaleone.space/27748398415nsiew.pdfIn PDF document text
    • http://sawemawe.mywebcommunity.org/the_fall_guy_season_5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://907864b8-ab38-4b43-b195-7646ee37c451.filesusr.com/ugd/c4b402_1febea59a3724db181f13833c0f6ca73.pdf?index=trueIn PDF document text
    • http://serekosesera.rf.gd/9084168991.pdfIn PDF document text
    • http://kuxomexepus.epizy.com/children_s_halloween_mask_templates.pdfIn PDF document text
    • http://zitulogakapede.myartsonline.com/73018653918.pdfIn PDF document text
    • http://wozubegozib.rf.gd/how_much_water_do_you_add_to_avent_microwave_steriliser.pdfIn PDF document text
    • https://4bbf79d8-97e4-42de-9a75-948158c354f0.filesusr.com/ugd/52f5d3_dcd41530a7a245dcab9d1dbf1971487e.pdf?index=trueIn PDF document text
    • http://puribisipup.atwebpages.com/mijami.pdfIn PDF document text
    • https://1a2149e7-ca7f-4e7c-a584-0e483de6f3af.filesusr.com/ugd/9219f8_dc8b38f11c674b9aa754b5638a028f3e.pdf?index=trueIn PDF document text
    • https://3bdad275-8828-414d-9063-9532e035d791.filesusr.com/ugd/c67d0c_2d70c75d578b4beda70e8013382e3d7f.pdf?index=trueIn PDF document text
    • https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_0b1c13742cf6401a8e97ee543f581e78.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f085.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF085 6744 bytes
SHA-256: b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808
font_01_sfnt_off0001016a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1016A 4912 bytes
SHA-256: ebb7e42f39845d6cbab29f977972ee7d2970ffeb3f663fd27f41ca69d8d1f063
font_02_sfnt_off000111f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111F8 1840 bytes
SHA-256: 39fb62d24bd54d4cff90e75353e2f51bc194a482803ce5872e41bed0e07153dd
font_03_sfnt_off00011af3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11AF3 12572 bytes
SHA-256: ff57278e27578069b8804208ff93c5e79968846f5e4640d328c62ad15b458bbb
font_04_sfnt_off000143e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143E8 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e