Malicious PDF — malware analysis report

Static analysis result for SHA-256 f198a780740bd54b…

MALICIOUS

PDF

92.7 KB Created: 2021-03-27 16:38:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 339d13edc349d5fe300d8ef5d41d4f18 SHA-1: 66d7130cf6bf4c197f47371f73d5d5fa96631045 SHA-256: f198a780740bd54b764dc432106a105f7131695e441c487126cc334489bcae7f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. The embedded content, though heavily obfuscated, appears to be a lure for a malicious website. The ML classifier strongly indicates maliciousness, and the presence of many external links points towards a distribution or phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9926

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=bad+eggs+online+2+unblocked+abcya PDF link annotation
    • https://jibajupo.weebly.com/uploads/1/3/1/6/131636806/ligigepefuritudo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390660/normal_603ab94bcb092.pdfIn PDF document text
    • https://jepololazatozuj.weebly.com/uploads/1/3/4/6/134601538/nebifi_dazavowu_tuguxiv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454813/normal_603a7e6df3b9e.pdfIn PDF document text
    • https://bukodebavuv.weebly.com/uploads/1/3/4/6/134657655/sarevow-xizigebizo-vikapesakazokoz-zezetos.pdfIn PDF document text
    • http://fonujameritules.getenjoyment.net/capsule_chapter.pdfIn PDF document text
    • https://pulimogub.weebly.com/uploads/1/3/4/3/134312020/gadezowuj-jobuzatag.pdfIn PDF document text
    • https://tererenigi.weebly.com/uploads/1/3/1/4/131405956/f192cc66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461746/normal_6032cc475df91.pdfIn PDF document text
    • https://roxopukerij.weebly.com/uploads/1/3/4/3/134396723/xebupofowubid.pdfIn PDF document text
    • https://babipuwoze.weebly.com/uploads/1/3/4/8/134865032/namojawanubojikixid.pdfIn PDF document text
    • https://bexaxaxaf.weebly.com/uploads/1/3/2/6/132682125/kovukela.pdfIn PDF document text
    • http://lirifajo.sportsontheweb.net/62255034143.pdfIn PDF document text
    • https://takadoturig.weebly.com/uploads/1/3/4/1/134108809/91fb4378df.pdfIn PDF document text
    • https://kokezixunilo.weebly.com/uploads/1/3/4/0/134096179/wexatazob.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f1c6091-6c0d-4ccd-8a51-9f3fc7ab6696/how_to_check_word_count_on_powerpoint_2007.pdfIn PDF document text
    • https://7095e710-59ac-4d27-8a5a-f3bbcaf65deb.filesusr.com/ugd/418e76_c8605bcc7e0a46c59e8cc6c089681bdf.pdf?index=trueIn PDF document text
    • https://62dace35-232c-43a2-b3e8-6cf19ad57148.filesusr.com/ugd/42ae31_d6d724b5bdeb40feb423fb034ba00322.pdf?index=trueIn PDF document text
    • https://64f1e6a9-4530-4009-9f9b-67b91dd69f79.filesusr.com/ugd/76b6de_9bfca86a549d4bfaa70856349cd4fced.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6b6aef0-8dc0-444e-b759-864def7c1e88/dell_latitude_e6410_i5-520m_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f88299f4-d07c-49ef-8185-5fe2fcb55274/12.4_volume_of_prisms_and_cylinders_worksheet_answers.pdfIn PDF document text
    • http://tikeresepujel.onlinewebshop.net/acer_aspire_v5_charger_best_buy.pdfIn PDF document text
    • http://namepafubi.atwebpages.com/sejozuboramifiluladi.pdfIn PDF document text
    • https://d1b33a7b-cde1-45d4-bc15-d4d3b6236ac5.filesusr.com/ugd/1d64af_bab2cd97f0894d908003c2d695f9a31a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4f51347-dba6-408d-815f-da5cb9a6a437/dodulinidurefave.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abcebd85-090e-4034-8602-ea133a84fe0a/22814767292.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f73a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF73A 5500 bytes
SHA-256: aabec81a9ecc01a914f074297d23caae34fb595f4185fe4798a5d637f147f65e
font_01_sfnt_off00010a13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A13 8888 bytes
SHA-256: db55a11365efb72fa626e4d563f6fbc80c01860a1c29224e90e44e6cb5406aa0
font_02_sfnt_off000126d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126D3 12016 bytes
SHA-256: f5bdde1293c3e16d6df6f880b122e84d270523792af66d6f73f1e08de0c7f829
font_03_sfnt_off00014dcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14DCD 16452 bytes
SHA-256: c165dc653998c562d979f14fa5bc8ee6dfc43a8a26644be9ced7c9facdf0e717

Open this report in the interactive analyzer, or submit your own file for analysis.