PDF malware analysis — malicious · efa7e68fc055f1e8

MALICIOUS

PDF

88.2 KB Created: 2021-03-22 16:14:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 0f608feb69fd6d060bad6a016d63a7d0 SHA-1: 7a2847fcdbee90f92405a558d83b0d0d4a7d7e4d SHA-256: efa7e68fc055f1e8b6e88366d0c94273b20c5b9755687dd70b66e2cf324674a6

126 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document functions as a link farm, presenting numerous external links disguised as SEO-optimized content. The primary URL, 'https://druttle.ru/wix?keyword=snaptube+apk+download+for+iphone', suggests a lure for software downloads. The ML classifier strongly indicated maliciousness, and the presence of a mass external link farm on disposable hosting further supports a malicious intent, likely to redirect users to potentially harmful sites or downloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/wix?keyword=snaptube+apk+download+for+iphone PDF link annotation
- https://cdn.sqhk.co/kululojilo/76ry1co/art_of_war_heroes_download.pdfIn PDF document text
- https://cdn.sqhk.co/bodujemep/k9g6hfU/fidget_spinner_coloring_pages_printable.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456378/normal_600c415413766.pdfIn PDF document text
- https://cdn.sqhk.co/gilitejeku/Qibjgii/five_nights_at_freddy_s_2_demo_unblocked.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489596/normal_60222d528337b.pdfIn PDF document text
- https://cdn.sqhk.co/kixarozikej/AkggvGX/niraverezubajovejutuxew.pdfIn PDF document text
- https://cdn.sqhk.co/mofosalamo/BHiirhd/27540312643.pdfIn PDF document text
- https://cdn.sqhk.co/lijumifi/hjWjcjg/lowegalisoweguv.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_20482898ab124f77813ba36492c63197.pdf?index=trueIn PDF document text
- https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_1d36cef392c741e3a97980c969ad6bb6.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nafoxuda/kesizujojogokofo.pdfIn PDF document text
- https://a40b6db0-1679-4e03-879f-ac5827b9aa7d.filesusr.com/ugd/dba42a_00b3aba268064bb48bfe664e27d1d8a8.pdf?index=trueIn PDF document text
- https://ab60d57a-1f92-408f-9079-0b325776b613.filesusr.com/ugd/724fb5_774a71472cf64bd1a6af7254d0e9c112.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1cd60161-207c-4379-a8e0-60dd8322f968/81836421918.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1bbbc007-5a5c-4a60-b4f8-00bed3008c4d/examples_of_database_management_application_software.pdfIn PDF document text
- https://s3.amazonaws.com/pujinit/elcometer_106_adhesion_tester_manual.pdfIn PDF document text
- https://s3.amazonaws.com/baxegezivumi/gukigoromajibe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8bcbcf43-9def-4ebc-9db3-9bf805b59408/surewevapekusoxetal.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b946eb80-2937-405b-89d0-d8e922ff8c5e/sufatawatufujiw.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010cc4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10CC4	5232 bytes
SHA-256: `d8b11d00d3c74552351c3f206b10fb0afb6f4a55bab5de2f377038b7c3ce512b`
`font_01_sfnt_off00011e8b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11E8B	11308 bytes
SHA-256: `bce6ea2de9be80e3b95eefedc688d361e9bedb305d13c28fe57ed222b77caeb2`
`font_02_sfnt_off000144f4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x144F4	4324 bytes
SHA-256: `ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230`

Open this report in the interactive analyzer, or submit your own file for analysis.