Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff3179174db8d24c…

MALICIOUS

PDF

78.8 KB Created: 2021-03-26 05:41:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 66808c05e4ce3010396dc971b7f0cafc SHA-1: 5fa292d312e697005a6da8ada32e57bb5c1230a1 SHA-256: ff3179174db8d24c8d35a760ce653cec09afd6d3a639f8b19d374cfec4fcda74
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, with a primary focus on a lure for "Pixel gun 3d hack android and ios". The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates the document is designed as a link farm on disposable hosting, suggesting a malicious intent to redirect users to potentially harmful sites. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=pixel+gun+3d+hack+android+and+ios PDF link annotation
    • http://gamedv.design/lowrance_hds_7_gen_2_for_salei8n14.pdfIn PDF document text
    • http://legalvictory.group/98778694218grdjv.pdfIn PDF document text
    • http://suporefebakibur.mygamesonline.org/what_are_the_components_of_a_news_story.pdfIn PDF document text
    • http://jifarobajis.sportsontheweb.net/poturidedojozuzitad.pdfIn PDF document text
    • http://blekrossi.ru/shri_vishnu_sahasranamam_in_hindifom3i.pdfIn PDF document text
    • http://good-production16.site/que_es_efectividad_en_administracionve55r.pdfIn PDF document text
    • http://zojidetamosab.iblogger.org/how_to_turn_off_clean_light_on_braun_coffee_maker.pdfIn PDF document text
    • http://nubolutlion.xyz/ladijugusizanijpjdan.pdfIn PDF document text
    • http://livethailand.fun/icse_9th_class_maths_book_free_downloadngsek.pdfIn PDF document text
    • http://ezfix.asia/one_ui_android_pie_split_screen5n8et.pdfIn PDF document text
    • http://lbaranaydin.com/is_craftsman_remote_compatible_with_chamberlain0ivi6.pdfIn PDF document text
    • http://fejukoturig.medianewsonline.com/ml_a_gr_calculadora.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nasakil.rf.gd/fonctionnement_carburateur_a_membrane.pdfIn PDF document text
    • http://midofel.rf.gd/free_autocad_viewer_software.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d405eb3-7ca3-41b8-a9db-248bfcde7cb7/what_is_creon_role_in_oedipus_rex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abbf10fc-17bd-4433-9069-3470f41a7b48/10722366483.pdfIn PDF document text
    • https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_762a33e31ba04daa86a7981571322563.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/46ddaf34-3a3b-47c1-b975-5735142ba870/how_to_use_lg_heat_pump_dryer.pdfIn PDF document text
    • https://8ac5c8e1-9174-427d-95c2-90bebb9f105a.filesusr.com/ugd/44b221_25aed8dc600747c88fb22573dae50926.pdf?index=trueIn PDF document text
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_541bd78f50044a5e97aa76954b0bd6cc.pdf?index=trueIn PDF document text
    • http://pugomifo.epizy.com/8143591805.pdfIn PDF document text
    • http://xasupanijit.epizy.com/94313074867.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77195319-b0fe-4728-9609-cbc86d7d5765/99603327542.pdfIn PDF document text
    • http://jelomasulavi.atwebpages.com/amharic_music_lyrics.pdfIn PDF document text
    • https://4123e755-5e7e-4fb8-b167-49ba90d37259.filesusr.com/ugd/fd3290_0807e5f8cda742a0b7c561b6d804c277.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f50a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF50A 5496 bytes
SHA-256: aaf0e66868aa71fc06d6dd98d0143d4c54c3467e0bb97d2910794a73b6b14e2f
font_01_sfnt_off000107bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107BD 10912 bytes
SHA-256: f33d6511b9dd50b7256669d9e88094639b1a8f66a66c3bb9450a456d27360a3c

Open this report in the interactive analyzer, or submit your own file for analysis.