Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0ca8a0ada05d382…

MALICIOUS

PDF

82.0 KB Created: 2021-10-08 21:32:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 3e7c3ae7ad912fa5fbf843a2148fdcef SHA-1: c5ac7c7adabf6e8267a3cebaf39567dd5cf80bba SHA-256: f0ca8a0ada05d382c0ec877af0af74cb92f9d4808122a86655086f97d849e757
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The sample is a PDF file flagged by an ML classifier as malicious. It contains numerous embedded URLs, with one heuristic specifically identifying it as a 'link farm on disposable hosting'. While the document body is heavily obfuscated, the presence of many links suggests an attempt to redirect users to external resources. The primary attack pattern involves directing users to a collection of links, likely to host further malicious content or for SEO abuse.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://studiotecniconuti.it/userfiles/files/82710024915.pdf
    • http://gshosnab.ru/userfiles/file/fumosewozova.pdf
    • https://cfacgroup.com/uploads/FCK_files/file/ninasuw.pdf
    • http://skncn.com/u/files/romabuliruwileso.pdf
    • http://cephedanismani.com/images/pages/file/porufitadozugi.pdf
    • https://bientannamhuy.com/wp-content/uploads/files/makepekefovugubifazisi.pdf
    • http://noxsun.com/jingkelun/userfiles/files/20210928214322.pdf
    • https://livnica-metalurg.com/images/pages/file/8611922250.pdf
    • https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/d0796eb5c2a158769ad23bc899497fc8/5630832942.pdf
    • http://briztravel.com/upload/files/38933834028.pdf
    • http://mosme.org/uploadfile/files/viwekudas.pdf
    • http://doo-san.com/userfiles/file/20210924114941.pdf
    • http://maskaevlawyer.ru/userfiles/file/72475486449.pdf
    • http://logistra.fr/ressource/site-image/files/93865834405.pdf
    • http://shop-cartuning.com/userfiles/file/watava.pdf
    • http://yaqeen-eg.com/userfiles/file/wonomewinubel.pdf
    • https://cottonweb.net/userfiles/file/27024042986.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=vitally+important+meaning
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d43b.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD43B 16792 bytes
font_01_sfnt_off0000ec4d.bin
f1f589b6c83d7f949d64f36fbb13548fb831cce3145342cc04a46b00f494fb55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC4D 21096 bytes
font_02_sfnt_off000122fb.bin
ae393e573605d6a912a7e616f75f80209f915c60a9a1ff364dd0620dfd1e7e26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122FB 10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.