Malicious PDF — malware analysis report

Static analysis result for SHA-256 10c481b5ae5119a4…

MALICIOUS

PDF

48.3 KB Created: 2020-10-16 14:06:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 13353d0831e5f3f5dab754bb6cbfe196 SHA-1: cb69fbe7cbb1883678e2643924ab06a46bb1efc2 SHA-256: 10c481b5ae5119a40ab0aee825ec7c5ffa98abc03803b868fc61c91a98227823
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link that redirects to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the URL and appears to be a lure related to 'writing a book review'. The presence of numerous external PDF links also suggests a link farm, potentially for SEO manipulation or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/123?keyword=writing+a+book+review+pdf
    • https://cdn-cms.f-static.net/uploads/4366987/normal_5f8758c71bfbb.pdf
    • https://vozutadisifik.weebly.com/uploads/1/3/1/4/131483249/magusewuk.pdf
    • https://rabexowubomisuw.weebly.com/uploads/1/3/1/4/131407155/tadetinaweze_pefekibuj_zutojiguretodo_ladilinawezev.pdf
    • https://tenagudewujuga.weebly.com/uploads/1/3/1/1/131164273/rikigun-gugemuguzeveg.pdf
    • https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/fcbfa66.pdf
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/kirorafagosox.pdf
    • https://moxoviwepikiwu.weebly.com/uploads/1/3/2/8/132814726/jiwulabinodutul.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/tunitulo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0500/4689/4240/files/jackpot_party_casino_mod_apk_download.pdf
    • https://cdn.shopify.com/s/files/1/0481/7000/8727/files/mifemoxulo.pdf
    • https://cdn.shopify.com/s/files/1/0501/7426/3456/files/tevapuzanizejusekomamujub.pdf
    • https://cdn.shopify.com/s/files/1/0499/6120/5924/files/dna_structure_worksheet_chapter_17_answer_key.pdf
    • https://cdn.shopify.com/s/files/1/0499/8332/4320/files/31207458804.pdf
    • https://cdn.shopify.com/s/files/1/0483/7218/7287/files/tomijijaxukal.pdf
    • https://cdn.shopify.com/s/files/1/0500/0429/5840/files/mini_nutritional_assessment_nestle.pdf
    • https://uploads.strikinglycdn.com/files/97a259ee-ddf8-4d40-8c97-5b2407da64f9/55599866122.pdf
    • https://uploads.strikinglycdn.com/files/8d8b9cc2-cf2c-467e-9152-6f30173dd8e4/dolexafuz.pdf
    • https://uploads.strikinglycdn.com/files/3717031e-b804-4ee4-9f54-bcb7129a715d/fumivafo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007ecd.bin
eb3337160192ef77adfdb7db86e6f21b94f58174b63cf9f092124eaaafa42d9a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7ECD 5368 bytes
font_01_sfnt_off0000913b.bin
63e09a8c5153f34546e49a0d1aa8d15c0ea03969322cc88cde8eee22254e06c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x913B 10316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.