Malicious PDF — malware analysis report

Static analysis result for SHA-256 e724c5a390fc10ad…

MALICIOUS

PDF

69.2 KB Created: 2021-10-02 10:59:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-11-24
MD5: ae09333d87648d44d69dca6187cdba8a SHA-1: 70778be4a15a8bb72581f619ffa3357b24625de7 SHA-256: e724c5a390fc10ad5842d88cf67e3c36523aabbdc5245bcfa667fd2c8a5b7ee6
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by an ML classifier as malicious. It contains numerous embedded URLs, many of which point to PDF files hosted on various domains, suggesting a link farm or redirection mechanism. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a high number of links on disposable hosting, reinforcing the idea of a malicious link aggregation strategy. No scripts were extracted, but the presence of many external URIs suggests the document's primary purpose is to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://autoklej.pl/app/webroot/media/files/timomobo.pdf In PDF document text
    • http://ashioke.com/images/library/File/vevinivukurazidesok.pdfIn PDF document text
    • https://dutchhaves.com/uploads/files/202109282110524248.pdfIn PDF document text
    • https://12shio1.com/contents/files/39788324188.pdfIn PDF document text
    • http://spellenindex.nl/images/uploads/gimagesekewu.pdfIn PDF document text
    • http://progetec.org/userfiles/files/damorokapazowojo.pdfIn PDF document text
    • http://czernavendeghaz.hu/admin1/file/ladivutubosemetajede.pdfIn PDF document text
    • https://srsatta.com/ckfinder/userfiles/files/jotomobojesinumegixiva.pdfIn PDF document text
    • http://rabotatver.ru/userfiles/admin/6340300795.pdfIn PDF document text
    • https://riwg.in/userfiles/file/pomozizopok.pdfIn PDF document text
    • https://presstone.hu/userfiles/file/xixawanalajimuruw.pdfIn PDF document text
    • http://master-br.ru/img/file/8820805596.pdfIn PDF document text
    • https://visaonline-vn.com/wp-content/plugins/super-forms/uploads/php/files/fmf87glh1h56r8agukj6331kb4/rabitekurusigojulus.pdfIn PDF document text
    • http://28777886.com/Lpf/UPFILE/userfiles/files/xotukoramar.pdfIn PDF document text
    • https://carlojans.com/cms/file/8686602337.pdfIn PDF document text
    • http://siamsnail.com/media/userfiles/files/23180715454.pdfIn PDF document text
    • https://kalendarz.probik.pl/fckeditor/userfiles/file/88495624201.pdfIn PDF document text
    • https://zoomkish.com/basefile/zoomkishcom/files/dizejarofok.pdfIn PDF document text
    • http://www.huntsvillepr.com/files/files/lozaposokitovufada.pdfIn PDF document text
    • http://www.bufolari.com/public/immagini/file/vilepuwaka.pdfIn PDF document text
    • http://www.detskaoptika.cz/ckfinder/userfiles/files/lipubuwilisodexu.pdfIn PDF document text
    • http://cottoneauto.it/userfiles/files/gubibumokanif.pdfIn PDF document text
    • https://fiberglasssupplydepot.com/userfiles/file/78800483966.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=black+color+blood+in+periodsPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ae60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE60 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000c677.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC677 10696 bytes
SHA-256: 099b87705bb476fb7a42d05bdf6c6ebc3ef09e3c499f4f034612edabd85a66d2
font_02_sfnt_off0000dedb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEDB 15668 bytes
SHA-256: 92d0e022afc8c328d12c0fe426be39af3d20c2850240429da9248bf80903ad37

Open this report in the interactive analyzer, or submit your own file for analysis.