Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc7f7c2b0dc25189…

MALICIOUS

PDF

58.5 KB Created: 2021-02-14 14:41:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a3093b5f9c8d5ca6b2eaacc50cb8b3d3 SHA-1: 26f7ca440fc61e5868bc5694bec101a5ccda8147 SHA-256: fc7f7c2b0dc251890adff81d4e0ca85e4a736ad8ce124bb90d1c89e1e5f7b656
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple external links, with a critical heuristic identifying it as a link farm. One of the primary external URLs is https://maypoin.ru/123?utm_term=the+100+season+3+episode+14, and another linked PDF is at https://firerokuk.weebly.com/uploads/1/3/1/1/131164187/kosesaxomomi.pdf. The document body is heavily obfuscated and appears to contain metadata related to its generation, not user-facing content. No scripts were extracted, but the presence of numerous external links suggests a phishing or content-luring attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8255

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=the+100+season+3+episode+14
    • https://firerokuk.weebly.com/uploads/1/3/1/1/131164187/kosesaxomomi.pdf
    • https://cdn-cms.f-static.net/uploads/4410702/normal_600bc9f611be7.pdf
    • https://lefoteliwe.weebly.com/uploads/1/3/4/0/134095852/7bd151.pdf
    • https://static.s123-cdn-static.com/uploads/4487662/normal_6001f69e43ba4.pdf
    • https://cdn-cms.f-static.net/uploads/4380883/normal_600a77668fccb.pdf
    • https://nibawisid.weebly.com/uploads/1/3/1/0/131071209/tubeguxivab.pdf
    • https://cdn-cms.f-static.net/uploads/4417119/normal_6025315f693ea.pdf
    • https://cdn-cms.f-static.net/uploads/4381766/normal_6027b23ad8c4d.pdf
    • https://static.s123-cdn-static.com/uploads/4458833/normal_5ff8d66655a5e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zinudipir/68558183479.pdf
    • http://xatudoxi.epizy.com/water_cycle_diagram_worksheet_high_school.pdf
    • https://s3.amazonaws.com/kubafezin/83539662341.pdf
    • https://s3.amazonaws.com/vuterijoze/cnbc_halftime_report_final_trade_today.pdf
    • https://s3.amazonaws.com/ligole/anatomy_muscle_manual.pdf
    • https://s3.amazonaws.com/fotepopunaj/burgundy_long_sleeve_formal_dress_australia.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d49f.bin
2f1784c64a52998f2ce222f246a2237962c546eebb0befcd46a1599891dc5095		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD49F 5024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.