Malicious PDF — malware analysis report

Static analysis result for SHA-256 eaf554b7de4baa44…

MALICIOUS

PDF

80.4 KB Created: 2021-03-25 00:43:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aa3c66719938d6d672161c3f5663e122 SHA-1: 7cbd74959e6005ff4fe7c1a295bf19f1eb3ee7d8 SHA-256: eaf554b7de4baa445cd37ad024fa954161f3ef9501b7ed6119a8e620c2e83072
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, many of which point to disposable domains and appear to be part of a link farm, suggesting a phishing or redirection scheme. The ML classifier strongly indicated maliciousness, and the presence of external URIs further supports a malicious intent to redirect users to potentially harmful content. No scripts were extracted, but the overall structure and URL distribution are indicative of a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=skulduggery+pleasant+2+pdf
    • http://kuzososo.mygamesonline.org/60941260630.pdf
    • http://kipokefurur.mygamesonline.org/free_story_elements_worksheets_2nd_grade.pdf
    • http://pazujiz.mygamesonline.org/trials_of_apollo_book_5_wiki.pdf
    • https://javekekowunafot.weebly.com/uploads/1/3/5/3/135324960/gadutituk_wazabuponar_milivo_vegolob.pdf
    • http://valuburikodajad.medianewsonline.com/2012_camaro_repair_manual.pdf
    • http://fogafiv.mypressonline.com/dolosapalijukomatevab.pdf
    • http://lorakuze.sportsontheweb.net/ximujitinifav.pdf
    • http://bukupiduge.mypressonline.com/51977386725.pdf
    • http://wimudevereru.sportsontheweb.net/riesgos_psicosociales_definicion.pdf
    • http://warokibujiz.getenjoyment.net/kaxogebabaxelabewine.pdf
    • http://kigetipopizatij.getenjoyment.net/hp_laserjet_pro_m1212nf_multifunction_printer_driver_download.pdf
    • https://vodefuba.weebly.com/uploads/1/3/4/6/134688083/3898800.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vafitinupisojud.onlinewebshop.net/abnormal_child_and_adolescent_psychology.pdf
    • https://uploads.strikinglycdn.com/files/2ad026f6-dece-4c7e-834b-89618cd4bfc9/why_isnt_my_skullcandy_bluetooth_headphones_connect.pdf
    • https://s3.amazonaws.com/gozifep/maintenance_cost_of_cessna_172.pdf
    • https://s3.amazonaws.com/tesasubawalozan/10881268130.pdf
    • https://uploads.strikinglycdn.com/files/231c41fd-fa9d-4bb2-9731-4d92a78fb9ee/how_to_use_a_jenn_air_self_cleaning_oven.pdf
    • http://zitulogakapede.myartsonline.com/rilomefavizefudugitejum.pdf
    • http://gakilasefit.myartsonline.com/dometic_ac_fan_not_working.pdf
    • https://s3.amazonaws.com/zuxime/math_worksheets_5th_grade_common_core.pdf
    • https://uploads.strikinglycdn.com/files/75948837-2f41-48a3-a6b7-fb4d0860964d/how_to_clear_memory_on_omron_blood_pressure_monitor_bp786.pdf
    • http://vibirokudod.myartsonline.com/seek_and_destroy_bass_tab.pdf
    • https://uploads.strikinglycdn.com/files/bf428bf2-9443-421c-9583-986a5a2a27da/unitypoint_urgent_care_marion_check_in.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc0b.bin
b83d3ce8eab47a3e9216bd6eb5288bd9c211aabd4987b64fb0cfeed63d406522		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC0B 5608 bytes
font_01_sfnt_off00010f3d.bin
cd2a3cc4a4d0dcf6ad3e6cf4763b87f97dee742e64b2d55752e104c80e6f2c1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F3D 10820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.