Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3eec9e98b868973…

MALICIOUS

PDF

87.0 KB Created: 2021-03-21 20:40:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 71e78aacc2819966f912875cbfbe4333 SHA-1: af973fb439953f09d0edcd5dfaf142c4e84da1c7 SHA-256: f3eec9e98b868973e5739e6ab001f18f51c267f66d5cd8a71e4a4cebd9ab212b
166 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation tactic. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document may also be instructing users to open a password-protected archive, a common method to bypass gateway security. While no scripts were directly extracted, the presence of embedded URIs and the ML classifier's high confidence score suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=baofeng+dm+5r+manual+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4408187/normal_604ae447d24c1.pdfIn PDF document text
    • http://lnstagramverifiedbadgeshelpcenters.net/how_to_find_the_general_rule_of_a_quadratic_sequence8qug1.pdfIn PDF document text
    • http://axecheat8.xyz/chicco_keyfit_travel_system_reviewsfxblf.pdfIn PDF document text
    • https://cdn.sqhk.co/fagaxirupunu/gxuhfgi/sefuxusubeb.pdfIn PDF document text
    • https://cdn.sqhk.co/veleviziwew/Bmbhctb/fallout_3_game_of_the_year_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/jotepomi/hd4jgfr/power_hover_mod.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384039/normal_5fdb584a37836.pdfIn PDF document text
    • http://ppl-nutrshopfit.website/advance_auto_parts_near_meiw7fj.pdfIn PDF document text
    • https://cdn.sqhk.co/tuwesedujila/YAhbihU/sinininobemotinawuri.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff3203f7-8254-4c9e-97c6-1c51e3a9056d/autocad_lt_2013_for_mac_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/casio_alarm_chronograph.pdfIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/46305149879.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7076e5e3-272b-4046-a3a2-9ee5cf15e979/tipafabolizugesaxofit.pdfIn PDF document text
    • https://469ee322-798e-4c1d-9571-af6764901f97.filesusr.com/ugd/57169b_bb699a28b8ca495fba754f4206eece7d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f045c20-2868-425d-8fca-09448532c5cf/zavugi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02f75f10-143c-4fdb-9399-dd5f26ba27d9/sony_bravia_32_inch_tv_stand_screws.pdfIn PDF document text
    • https://s3.amazonaws.com/vedexajawo/what_kind_of_transmission_fluid_for_2015_honda_civic.pdfIn PDF document text
    • https://s3.amazonaws.com/wejuvono/what_does_pandoras_box_symbolize.pdfIn PDF document text
    • https://dae57379-2785-4108-a223-4562ecbfc22e.filesusr.com/ugd/87ad98_e87623d5cd1e429eb25df3a8a07acc57.pdf?index=trueIn PDF document text
    • https://989eff4c-946f-4221-9817-1a8d60f2082d.filesusr.com/ugd/7edf14_75c0d5bbeece4402b5a9b1965ca4e1ed.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/niwotipugonuvoz/crystal_report_rpt_viewer_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8466c951-ef99-423b-8d7d-46942491028a/nunifuxekamugekejusojiv.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001056f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1056F 4328 bytes
SHA-256: 1c45339bf68f7d94e07db3b5786bbd32f1f239df1266e86eb97d3d6788c882d6
font_01_sfnt_off000114a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114A9 5356 bytes
SHA-256: a86468630d252e7157b0d142d521a57f351f61719fd79ad80d3bc65f8daafbf4
font_02_sfnt_off000126cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126CD 11636 bytes
SHA-256: 35dd51c848eec3b2e3ae15cee4623b6b15e8aa53df8e2f97ce5f0ea0e59a5a33

Open this report in the interactive analyzer, or submit your own file for analysis.