Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d011fa820f7656b…

MALICIOUS

PDF

46.8 KB Created: 2020-10-26 23:40:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 4488e182571481ecc853d237a060f19d SHA-1: 9f4eda71f3ab7c2373944b800b3e5873b08201ce SHA-256: 1d011fa820f7656b608c831c8b0aed35e52a8ae80500454aa1de089cfba740c2
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link that redirects to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text related to 'Grand theft auto 5 free download for android apk' and the malicious URL, suggesting a lure to trick users into downloading malware. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=grand+theft+auto+5+free+download+for+android+apk In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365575/normal_5f8722d9643ba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372719/normal_5f9470550763d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366028/normal_5f871d4727e0c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367007/normal_5f91f71fa6b97.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369318/normal_5f964a0fdf38d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381104/normal_5f92568c9e38c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366375/normal_5f964f24e58d2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366668/normal_5f872e7b21dec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372980/normal_5f91b6a858d77.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bejideba/adkar_sabah_wa_massa.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files/carnot_vapour_power_cycle.pdfIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/clinical_pharmacology_laurence_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/janodojivi/78016935701.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e94a4ee-2d8e-4f48-81aa-bb95b16dcb70/ruwixovutema.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66048966-4300-4a63-8493-0463ad5f49d2/35704518874.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75bf3495-abc1-4861-af60-c009d1ffe09e/maxiladutobar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/017b2f8d-c20e-4669-b4af-5e2b70107be0/nijebekojaneferetokizo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4aca2c9-17fc-4a66-8e99-40075432a6cb/kikuluruvivibatalevidava.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7660bef2-20a5-4645-9577-ca1125b85e5c/visiwegezimuwawika.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/319d025a-c2c9-43b3-87e8-1e9203a2d89b/kewotumeberomes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17bebc73-edb0-4bcb-bbb8-4c82c173da98/73310266451.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f72a9af2-c828-48bc-9eee-096cbd1a6873/95405884088.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000635b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x635B 3120 bytes
SHA-256: 16a0685b1af8f7ff3286410c82d065b2ef9dd16f5cc5e004aadb0dd239daad33
font_01_sfnt_off00006e8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E8E 5264 bytes
SHA-256: 7375119ff8363503dd2c4a3984e7f40272a0b0b4c4c7e31c68a5093493b9e257
font_02_sfnt_off00008089.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8089 15900 bytes
SHA-256: 7c50b5ba9e18ed76e014ea7051612e2a88f035ea988f36ec118227b2267f08ce

Open this report in the interactive analyzer, or submit your own file for analysis.