Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cad9109a6f349e6…

MALICIOUS

PDF

40.8 KB Created: 2020-11-05 17:19:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3223847f8074ba4e1c5d9222788ac755 SHA-1: d8b4e7de57051e925c2c98aebdf3d4b92a9b4a46 SHA-256: 0cad9109a6f349e66d903d36c94633576c0e7c327dad5f3b227a0974092237b1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, many of which point to Weebly-hosted PDFs and a redirector URL. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' indicates that one of the embedded URLs, 'https://ggtraff.ru/aws?keyword=synonyms+for+important+information', leads to known malicious infrastructure. The 'PDF_SEO_LINK_FARM' heuristic further suggests a large number of external PDF links, indicating a likely attempt to distribute malicious content or phish users. No scripts were extracted, but the embedded links are sufficient evidence of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=synonyms+for+important+information
    • https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/78259c9fc3.pdf
    • https://delutezebojuk.weebly.com/uploads/1/3/4/3/134353455/jurokudomomak.pdf
    • https://silepokow.weebly.com/uploads/1/3/4/3/134366863/vunagagutumizazimis.pdf
    • https://koxoganonigowup.weebly.com/uploads/1/3/1/4/131408343/894664.pdf
    • https://gunapozebufe.weebly.com/uploads/1/3/4/3/134316646/kuzubobu.pdf
    • https://cdn-cms.f-static.net/uploads/4384316/normal_5f92d78983d4d.pdf
    • https://cdn-cms.f-static.net/uploads/4378170/normal_5f979a47081bd.pdf
    • https://cdn-cms.f-static.net/uploads/4379744/normal_5fa093c2980c1.pdf
    • https://papunagaku.weebly.com/uploads/1/3/1/3/131384156/69287c9de2.pdf
    • https://cdn-cms.f-static.net/uploads/4372080/normal_5f9cb7a1363cc.pdf
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/jasamejug-jenutuzudemeluf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wusone/wanderungen_appenzell.pdf
    • https://s3.amazonaws.com/lakadutof/dolejadusa.pdf
    • https://s3.amazonaws.com/tapexiw/plantas_nativas_de_baja_california.pdf
    • https://s3.amazonaws.com/wonoti/gotuwajiwaresoxobunesuwu.pdf
    • https://s3.amazonaws.com/jamokaroxoj/sintomas_de_anemia_falciforme.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000627f.bin
deaf1b3178bf89d35b776df302dfd2c60fdbd6b650cd6f6663fb12f1c38a5763		 pdf-font-stream PDF embedded font (sfnt) at offset 0x627F 5220 bytes
font_01_sfnt_off00007431.bin
5788838adbdf15c2db0fb80246015e3fef141d792231da5bf0fcab8c811191f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7431 9872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.