Malicious PDF — malware analysis report

Static analysis result for SHA-256 0fc2f086196e283c…

MALICIOUS

PDF

46.1 KB Created: 2020-01-14 23:38:50 Authoring application: Aspose Ltd. (via Aspose.PDF for .NET 21.4.0)
MD5: 55a12e0b102fc97bbc15e5ffcaad73f3 SHA-1: cdc629604100c67392c40142d702e6479dbb9741 SHA-256: 0fc2f086196e283c50b2d3eb2e9f007d817de1bf85373b1837ff9726004dd8ca
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link disguised as a helpful resource for adding stamps to PDFs, which redirects to a known malicious domain. The heuristic firings indicate the PDF is a redirector and part of a link farm, suggesting a phishing or malware distribution attempt. No scripts were extracted, but the presence of embedded URLs and the nature of the heuristics strongly suggest a malicious intent to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8226

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=add+stamp+to+pdf+acrobat+pro
    • https://site-1040129.mozfiles.com/files/1040129/30812125201.pdf
    • https://site-1043582.mozfiles.com/files/1043582/juluruxajil.pdf
    • https://site-1042276.mozfiles.com/files/1042276/42680649781.pdf
    • https://site-1039188.mozfiles.com/files/1039188/52092049755.pdf
    • https://cdn-cms.f-static.net/uploads/4366959/normal_5f877e5f7ea89.pdf
    • https://cdn-cms.f-static.net/uploads/4366984/normal_5f87a2a6b6dc3.pdf
    • https://cdn-cms.f-static.net/uploads/4366965/normal_5f874fd70429f.pdf
    • https://cdn-cms.f-static.net/uploads/4369191/normal_5f87bb45c784f.pdf
    • https://sesuwulot.weebly.com/uploads/1/3/1/4/131438847/jumufowubaboduwibipu.pdf
    • https://migirebunimalab.weebly.com/uploads/1/3/1/3/131383914/pijom.pdf
    • https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/7706681.pdf
    • https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/goxarujemexogu_mosegozivi_fofuwad_kezobal.pdf
    • https://misopiwulasi.weebly.com/uploads/1/3/1/8/131856666/1945809.pdf
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/zanadutut_wexudafenatogun_jetomefoja.pdf
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/zidebesirolabavo.pdf
    • https://liwevapazu.weebly.com/uploads/1/3/1/0/131071299/4fd30b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://cdn.shopify.com/s/files/1/0433/6841/5400/files/how_many_calories_in_a_california_roll.pdf
    • https://cdn.shopify.com/s/files/1/0477/3730/7292/files/history_of_language_podcast.pdf
    • https://cdn.shopify.com/s/files/1/0431/2711/1841/files/5755943260.pdf
    • https://cdn.shopify.com/s/files/1/0496/1517/5829/files/flip_flop_frequency_divider.pdf
    • https://uploads.strikinglycdn.com/files/28406bbd-fa55-4f2a-a936-966d3a0bf5a6/31756256871.pdf
    • https://uploads.strikinglycdn.com/files/84d25418-d62c-4960-888f-823a07a4e401/nanawipurezogew.pdf
    • https://uploads.strikinglycdn.com/files/8c0c4ae1-1558-404c-8ded-455d10623d26/sosegavuziwonojor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c64.bin
5b9035010f0559a5dd46fa5e71487f13fa2eec61b3fad2420551f5d957cb68fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C64 4916 bytes
font_01_sfnt_off00007c49.bin
6dd74072bc174f586abf155662d04b0d15c38ea733c2b4a5236f06221a35b531		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C49 10248 bytes
font_02_sfnt_off00009e83.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E83 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.