Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd9055ad4378392f…

MALICIOUS

PDF

82.9 KB Created: 2021-09-19 09:18:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2021-10-14
MD5: b22cf408812b4989504c183822896ee3 SHA-1: 23c2be2be31ea412efaefbe9b6a6f16e137a65a9 SHA-256: fd9055ad4378392f50eab52e038086a0defe9e960bbff56015cd4e70e8651502
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs, with a high heuristic flagging it as a link farm on disposable hosting. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the structure and numerous external links suggest a campaign to redirect users to potentially malicious content, possibly for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://al-bandak.com/userfiles/file/16712434008.pdf In PDF document text
    • http://jianianhuayule.a9188.com/upload_files/art_files/files/20210903_053342.pdfIn PDF document text
    • http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/161405daf9a0e6---fugifasujen.pdfIn PDF document text
    • http://picart-personal.pl/fckupload/upload/file/57384049786.pdfIn PDF document text
    • http://medicaldistri.com/ckfinder_files/files/dopudukudasobesububeruv.pdfIn PDF document text
    • https://jxlmedu.com/file/files/20210911_105315.pdfIn PDF document text
    • https://zhongzing.com/uploads/files/202109140703238671.pdfIn PDF document text
    • http://creaorganization.com/depo/sayfaresim/file/muwezoxifeta.pdfIn PDF document text
    • https://tunguoilon.tunhua.vn/ipp/images/uploads/files/74288816968.pdfIn PDF document text
    • http://sahcarpets.com/userfiles/file/tiposuvuxabimamugoleri.pdfIn PDF document text
    • http://zavalinka.by/var/upload/file/86695049043.pdfIn PDF document text
    • http://www.pratikchoudhury.com/fckimages/file/tijuxiposarelulodaforudek.pdfIn PDF document text
    • http://elencostruzioni.it/userfiles/files/degenufazavomulunevax.pdfIn PDF document text
    • https://cryptobasics.biz/uploads/files/26533402199.pdfIn PDF document text
    • http://wxmx.cn/upload/ckimg/files/202109190714098469.pdfIn PDF document text
    • http://22vek-omsk.ru/fck_editor_files/files/natigalig.pdfIn PDF document text
    • http://autokolcsonzoszolnok.hu/admin/fck_upload/file/77068031581.pdfIn PDF document text
    • http://sensitiva.fi/UserFiles/File/50572317126.pdfIn PDF document text
    • https://adiwirawanbali.com/wp-content/plugins/super-forms/uploads/php/files/374406757e8ff29e9fd7b6f47c0c6575/10513922066.pdfIn PDF document text
    • http://tootingtaxi.com/survey/userfiles/files/5598602882.pdfIn PDF document text
    • http://strandedtattoo.com/file/pilelenulid.pdfIn PDF document text
    • http://ytbozhuo.com/upload/file/180114464740.pdfIn PDF document text
    • http://kenshopvn.com/uploads/files/xazipexuxarij.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/1xuhb7AK25c/uplcv?utm_term=wifi+enabled+calling+androidPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0C8 10516 bytes
SHA-256: 9297dbaef3445c7f3a10646ea6ff830b4f703143f510da7bd15d0f3e6d6094e0
font_01_sfnt_off0000f895.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF895 17576 bytes
SHA-256: a83888b2b9477a67dbde2f413972cf5f9171ca2ac50dcbbf18d2824919be4dfc
font_02_sfnt_off00012632.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12632 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.