Malicious PDF — malware analysis report

Static analysis result for SHA-256 160a1dc8d5fdade0…

MALICIOUS

PDF

48.9 KB Created: 2020-10-29 12:49:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 5be4351eab6065aee8307c322fa75c81 SHA-1: 2ca568001fd8a2a80faa1382ab00b9739e447c37 SHA-256: 160a1dc8d5fdade0e551c7b60bcd7c1b38e8506e47364d93a926d26fccf1ee1e
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF was flagged by multiple critical heuristics for containing a malicious redirector link and a large number of external PDF links, indicative of a link farm. The primary malicious URL identified is https://gettraff.ru/aws?keyword=yamaha+motif+es8+manual, which redirects to other potentially malicious content. The document body contains garbled text but includes the same URLs, suggesting an attempt to disguise the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=yamaha+motif+es8+manual In PDF document text
    • https://cdn-cms.f-static.net/uploads/4415950/normal_5f9902a3a7e15.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392877/normal_5f90ea1867cd7.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/davawina/my_hero_academia_wallet_gamestop.pdfIn PDF document text
    • https://s3.amazonaws.com/pibajuwi/hipoglucemiantes_orales.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/lozolejigigefagevoge.pdfIn PDF document text
    • https://s3.amazonaws.com/jojitagifuva/46629739562.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/244a33d2-eff1-4947-8bd9-fcba4af4fc46/17911825539.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99075da4-d969-4ffe-aa8d-7e01e0febe99/55811167848.pdfIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/kevopipirimexetegizubalix.pdfIn PDF document text
    • https://s3.amazonaws.com/subud/fundamentals_of_business_process_management_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c9bea8a-dfe8-4042-822b-f59bb9702c1f/84753418025.pdfIn PDF document text
    • https://s3.amazonaws.com/wefadep/ark_riot_armor_cheat.pdfIn PDF document text
    • https://s3.amazonaws.com/muwemivumazulax/putujisofutilevo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0477/2265/9996/files/71111881296.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/7029/1096/files/73780411826.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2c6bf5e-ef30-4927-88e3-3cac0953c757/buxalagopenuweza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db2f191e-f82e-487a-bc78-40d065a90855/cancro_al_seno_triplo_negativo_allo.pdfIn PDF document text
    • https://s3.amazonaws.com/mijedusovineti/dry_training_for_freediving.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/809a6548-c107-46f7-ace1-5dc0dd743ee6/vosogopukuxokuxotofa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000064b1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x64B1 13820 bytes
SHA-256: 673d30c85b501234dc3b86bb243a3bd485ad456316fb03b08dd36b970cf16778
font_00_sfnt_off000053a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x53A3 5064 bytes
SHA-256: f66d25042272cb715150b446b5a7b9c81d961c768d614cc81a5e121d569c8d3b
font_02_sfnt_off00008bdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BDD 12104 bytes
SHA-256: 1d59dc3e8ea1c757d18476182bf395bc6488501f4bb4f1d4583bdd10bf20128c

Open this report in the interactive analyzer, or submit your own file for analysis.