Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b9191cd2c773ea0…

MALICIOUS

PDF

49.4 KB Created: 2020-10-25 22:35:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: f410ee1b96b06401694a65f68a00660a SHA-1: 00a9f8acf5ae195cd30c089f011b506e281bc6ae SHA-256: 0b9191cd2c773ea04c3e4784fb312cd3a117b6cf0b015034347dfe20c02bbb31
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious due to its function as a link farm. It contains numerous embedded URLs, with at least one, https://cctraff.ru/aws?keyword=article+questions+and+answers+pdf, pointing to known malicious redirector infrastructure. The document's primary purpose appears to be directing users to external sites, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=article+questions+and+answers+pdf In PDF document text
    • https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/9b18cd795bd.pdfIn PDF document text
    • https://posolefuriw.weebly.com/uploads/1/3/4/3/134374222/xovetituvosomi.pdfIn PDF document text
    • https://xifobosakup.weebly.com/uploads/1/3/2/8/132815359/kebepimuvun_pawodusizopag_velozofaxen_fibef.pdfIn PDF document text
    • https://bilimetib.weebly.com/uploads/1/3/4/4/134435282/bb00eedc8502e.pdfIn PDF document text
    • https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/4992818.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1af8c24a-b65d-4bde-8726-0703cf7ca432/607227679.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0af917b-b0b2-457f-b87a-c154f9930d12/8807425931.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5799eac9-7fed-439a-a88a-d503eb3b876c/tojorajorujusemipemekuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/85c60d58-542e-405c-a9a8-d88f7313060c/53003691594.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0441/2506/1272/files/filasukikape.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0478/6814/9926/files/kiwixijupa.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/6802/5751/files/govoburabade.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/8042/6665/files/mobil_1_5w-20_high_mileage.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/2251/5865/files/bsc_2nd_year_botany_syllabus.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/0003/7527/files/watch_movies_online.pk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/3645/4307/files/projection_of_lines_questions.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/3846/6467/files/joshua_tree_national_park_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9025289d-230a-479c-b042-13e740413144/valery_altamar_colombia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30a97b74-d4a0-4bc8-9add-497f27a2bc26/zitanupa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/719cc213-bdd4-4cb8-a539-7dbad8bdf233/64420189716.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0ee1d50-1f7a-4273-880c-fe6f33bd39f8/savawubuparabeferonaleto.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2eba5d5-d47c-4006-afe1-8b324683b71b/robert_l_mott_mecanica_de_fluidos_pd.pdfIn PDF document text
    • https://s3.amazonaws.com/zalomi/analysis_and_interpretation_of_financial_statements_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/anglican_hymns_book.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008018.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8018 5356 bytes
SHA-256: f15f93dc7af4b1051de3ec338ca2a89dbeb5d7a598807aa2b8147c79cc5b600c
font_01_sfnt_off0000926b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x926B 10980 bytes
SHA-256: 34206f49d7a23745291dba4e2f95638ee2b43f987a2aa5a4b5132c6f4af5f870

Open this report in the interactive analyzer, or submit your own file for analysis.