Malicious PDF — malware analysis report

Static analysis result for SHA-256 1404179d3990aa30…

MALICIOUS

PDF

80.1 KB Created: 2021-03-11 18:33:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 374d23325458dc38e6177588f3b80b54 SHA-1: 8877c70dd5d25746e68bc5e49fa0f86f61d50df0 SHA-256: 1404179d3990aa30e673b01a8b4119a6353845b1898dde375b6d4bc672666fdb
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs, with a critical heuristic firing indicating it links to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains text suggesting a lure related to 'brainwashing', likely to entice users to click on the malicious links. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=how+to+brainwash+yourself+pdf In PDF document text
    • http://xisulekotitis.iblogger.org/rawajinositanikixo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385648/normal_5fded3ebd6101.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482188/normal_600d52ca266f3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418167/normal_6016e0577259f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zaxukesaludu.epizy.com/08_avenger_battery_location.pdfIn PDF document text
    • https://17a6c5a8-0587-4adf-8126-5b439e15a62f.filesusr.com/ugd/54bec1_8b843ca83dee4145876f882610b8ddff.pdf?index=trueIn PDF document text
    • http://powosegunivu.epizy.com/nufajejisulobaxomu.pdfIn PDF document text
    • https://s3.amazonaws.com/fajujiju/1689417679.pdfIn PDF document text
    • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_1b4aa6299c1e434e99eb8bdc7162037f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gofilafixu/vuzikoxorewenajulilususo.pdfIn PDF document text
    • https://s3.amazonaws.com/wekibik/surah_yasin_full_text_in_bangla.pdfIn PDF document text
    • https://2d130471-2a64-48ba-87cf-8f1e86c6acad.filesusr.com/ugd/9c43ec_2d531a8c6fa24f8daffeb3919c935839.pdf?index=trueIn PDF document text
    • https://b6086c54-8ef4-40f3-ba18-bbbb993b339e.filesusr.com/ugd/36e927_7a2fbdf3cd9b4045861e4640eff7279a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/setikizo/cch_chuyn_t_sang_nh.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxexi/life_is_strange_episode_2_diner_guide.pdfIn PDF document text
    • http://vonupov.epizy.com/tezujawogikafek.pdfIn PDF document text
    • https://d427386d-3434-45d9-8802-370857a594f4.filesusr.com/ugd/accd1f_3a4a03b01fe64fc68e6b41815a771d39.pdf?index=trueIn PDF document text
    • http://bimivopi.epizy.com/korobuxabalofelewugeb.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD01 5424 bytes
SHA-256: e1df7c508ea565273a9bc9868d089c9afc1e599581dd39730ff0e2f41b4c6075
font_01_sfnt_off00010f7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F7B 10992 bytes
SHA-256: f6e9ebe92138286bca4549f85e5d2aa75ef02a64c88e567518dc04d4acaa00a3

Open this report in the interactive analyzer, or submit your own file for analysis.