Malicious PDF — malware analysis report

Static analysis result for SHA-256 f80bb924ea1bd839…

MALICIOUS

PDF

79.4 KB Created: 2021-03-23 09:01:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 3987e5daaca37adb75c4b4229b485d15 SHA-1: 5917f9fdae8a0c694e1acc9bb6fd00bcf243e815 SHA-256: f80bb924ea1bd839b466ffb7993c177aa07d7418981f9488d588f38a67ad1f45
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=root+android+apk+download PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/toniseligiwuzux/26125532528.pdfIn PDF document text
    • https://8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com/ugd/da8f68_345ca2d2b5354f4492dfa7a4fe7a1b4a.pdf?index=trueIn PDF document text
    • https://113c517c-d7b0-4b36-99d7-6722bcb7ef36.filesusr.com/ugd/8e66a5_4dcd0776c3bc46eabef45c65f3c067ee.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/be48772e-f91e-492c-bd4e-9f7301d23629/kesugakivubozobugesowafa.pdfIn PDF document text
    • https://29bb9f0a-cb36-4278-8b1c-05d86a2267e4.filesusr.com/ugd/25e746_95ae1d2677de4afbbf0a749f83a54d63.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pevuwarobuvowa/tikeverodun.pdfIn PDF document text
    • https://s3.amazonaws.com/tigewibejageju/mavizugexelopelugeza.pdfIn PDF document text
    • https://s3.amazonaws.com/sojaxub/idaho_fish_and_game_steelhead_fishing_report.pdfIn PDF document text
    • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_fe35d17ee8894a949c33453125891637.pdf?index=trueIn PDF document text
    • https://492f55f4-3442-4b37-b17e-39d9f2f0ae8a.filesusr.com/ugd/7dfe85_402a8f45cd8641db94de2eb477853692.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/cede61db-b9ec-4a8c-ad14-ea3d57f0cb89/what_happens_if_i_overeat_for_2_days.pdfIn PDF document text
    • https://a91f1da9-0b84-486d-9199-d95c2ecdf19f.filesusr.com/ugd/82421a_55c1317382d0496b8b617d51ececf29b.pdf?index=trueIn PDF document text
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_95971a2abdfc40379d8ee804a5bb4f4b.pdf?index=trueIn PDF document text
    • https://e1c07d4e-6587-4767-b76f-5dea9cf3e327.filesusr.com/ugd/51a829_8b1c9feff4324db8b8969209f7cff684.pdf?index=trueIn PDF document text
    • https://b2f3f1fb-4f3f-4d5d-be65-f5b10dce6288.filesusr.com/ugd/735189_139271ec57c04f15820f2a12067a4f7b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jajoxulabojaso/losenexomewoxefigilinizim.pdfIn PDF document text
    • https://d62ff7d9-aefc-4ab8-8cdf-af38868aea16.filesusr.com/ugd/54b9a1_511fdffefcc04e5e919af8755586e7f4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a8ec95a-e079-424e-8914-001457a06ed3/18510044266.pdfIn PDF document text
    • https://s3.amazonaws.com/lorugipopuxe/date_expression_in_ssrs_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a9e612b-9213-4ffd-8027-c9f4c66b7181/walgreens_wrist_blood_pressure_monitor_directions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77c1c681-af8a-4526-bccb-0cda7951d937/zukerozewumaminu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d34b8b97-11e3-4584-a42a-a6d207009670/63041139781.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB1F 4936 bytes
SHA-256: 854c3a94aefbab88af0225546641bcf04038dd2de45118d3be5b4d5eb5fde8a0
font_01_sfnt_off00010c12.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C12 10628 bytes
SHA-256: 6658d156ccd5d576193ef968196f3a3c91dfe0f78e3b5a5ca6a976b8a1b1c99c

Open this report in the interactive analyzer, or submit your own file for analysis.