Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec8b55ad200adef7…

MALICIOUS

PDF

82.5 KB Created: 2021-03-22 18:27:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a113a62cb589633db282675dcc8eba3 SHA-1: 551344a7c4e535a898cefdd229188a7753735892 SHA-256: ec8b55ad200adef7d241d67ad94e4e40c3c4de423ed671dd32ecb5dce3e57a2f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified as a 'link farm' by heuristics, suggesting a malicious intent to redirect users. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of many external URLs indicates a likely attempt to host or distribute further malicious content, possibly via a spearphishing attachment delivery vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=5+dysfunctions+of+a+team+pyramid
    • http://afracheat1.xyz/telefono_informazioni_amt_genova3mdyr.pdf
    • https://cdn.sqhk.co/tusadopovet/qiaiitT/36313800012.pdf
    • http://jirafka.space/lujaxasenepunazugizoxuzjqb6.pdf
    • https://gukufevekexuse.weebly.com/uploads/1/3/5/3/135305262/ranonisutiso.pdf
    • https://cdn.sqhk.co/letaziseb/QoUNFhj/63123582974.pdf
    • https://nivuzodix.weebly.com/uploads/1/3/1/4/131410872/5df3d2357f8ee7e.pdf
    • https://xedijekotaz.weebly.com/uploads/1/3/1/6/131606072/katagesaperumiz-wexojepuropev.pdf
    • https://wojulifurezusek.weebly.com/uploads/1/3/1/4/131438898/motefenedaposev.pdf
    • http://busurman.space/army_promotion_board_bio_templatekfrr5.pdf
    • https://cdn.sqhk.co/savageven/Lwtjiji/my_sprint_app_not_working_2019.pdf
    • https://cdn.sqhk.co/kavejufa/6iiibhi/best_podcast_player_device.pdf
    • https://nefabilaj.weebly.com/uploads/1/3/1/4/131438225/2dbe64cd3d489.pdf
    • https://cdn.sqhk.co/salujokep/hdhgBjf/90905173975.pdf
    • https://katozela.weebly.com/uploads/1/3/0/8/130874493/a3a71a.pdf
    • https://cdn.sqhk.co/jigijobofofa/egLjchh/wavinutedenuvedel.pdf
    • https://ripodomix.weebly.com/uploads/1/3/0/7/130775876/3991874.pdf
    • http://disconto50.info/what_is_white_pizza_sauce_made_out_ofpj8cy.pdf
    • https://fejegexe.weebly.com/uploads/1/3/4/6/134617501/f538a68867c789.pdf
    • https://cdn.sqhk.co/xovepejegosi/1IhhB3C/gst_status_uttar_pradesh.pdf
    • https://rimekadosa.weebly.com/uploads/1/3/4/4/134467829/8acada1c39c062.pdf
    • https://puneliten.weebly.com/uploads/1/3/4/0/134040782/c157fa73f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gomokirov.rf.gd/1722649086.pdf
    • http://bazejufojowopor.epizy.com/xobugubusonupofilis.pdf
    • http://fobegagefim.epizy.com/75520372592.pdf
    • http://satonavuka.rf.gd/vejojuselin.pdf
    • http://botakifavek.rf.gd/sears_diehard_gold_battery_charger_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104c3.bin
5e071a60ec55ae4c74232d12853e2252391566e14cf985e481cb22052dd371b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104C3 5400 bytes
font_01_sfnt_off00011719.bin
c3b7760169e9e3b1d732a08fc1e77024c2b1300c35ad8999aaf087d4dce5a534		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11719 10900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.