Malicious PDF — malware analysis report

Static analysis result for SHA-256 239189eab1a066a4…

MALICIOUS

PDF

43.5 KB Created: 2020-10-29 13:38:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 46f90cbf7eaf9f6c3fb94406ec2c209d SHA-1: 3ce754453c1b131349b92cffab94f7e1b8017281 SHA-256: 239189eab1a066a44f8d5ecf373662cf23ada35a50a8fd28e346e7e1ab3c2ea7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is classified as malicious due to its structure, which contains a large number of embedded links pointing to external resources. The primary link, 'https://ggtraff.ru/aws?keyword=how+not+to+write+a+novel+pdf', is identified as a malicious redirector. The document's content appears to be a lure, disguised as a PDF about writing a novel, to encourage users to click on these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=how+not+to+write+a+novel+pdf
    • https://cdn-cms.f-static.net/uploads/4369331/normal_5f8a3efbd21a7.pdf
    • https://cdn-cms.f-static.net/uploads/4369160/normal_5f8f191183bac.pdf
    • https://donodofi.weebly.com/uploads/1/3/1/8/131856097/remiweneja-gadubisizijul-pinelixetamoxu.pdf
    • https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/xaperasopa.pdf
    • https://cdn-cms.f-static.net/uploads/4376372/normal_5f8bd27ae4947.pdf
    • https://belonimilulufaf.weebly.com/uploads/1/3/4/4/134403367/nugazu.pdf
    • https://cdn-cms.f-static.net/uploads/4401518/normal_5f9173507308c.pdf
    • https://bewupoterefi.weebly.com/uploads/1/3/1/3/131380107/dc7611a393ec.pdf
    • https://keruzexutebimoz.weebly.com/uploads/1/3/4/3/134310977/deeb0.pdf
    • https://suludizivot.weebly.com/uploads/1/3/1/3/131383823/b7d300133c960.pdf
    • https://cdn-cms.f-static.net/uploads/4375690/normal_5f8ba130d8a78.pdf
    • https://cdn-cms.f-static.net/uploads/4368497/normal_5f87e58348575.pdf
    • https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/jurogoz_pumopafabofin_tixozakipabom_nilot.pdf
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/jibigamefomoni.pdf
    • https://sopodepewujo.weebly.com/uploads/1/3/4/3/134340903/litimu_fuputawoxuv_modos_lonunovo.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/saxuvenimugugadeso.pdf
    • https://mogidudurunupiz.weebly.com/uploads/1/3/2/6/132695636/rijeseka.pdf
    • https://cdn-cms.f-static.net/uploads/4365589/normal_5f8a89267b910.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/edf29d7f-cc96-4254-97bf-47cb0abf2fe9/81621417485.pdf
    • https://uploads.strikinglycdn.com/files/cee86fbb-f946-402d-89cb-844668f17cf6/gel_blaster_mod_guide.pdf
    • https://uploads.strikinglycdn.com/files/542cf678-f092-40cd-8a58-21c4530f2838/96500663835.pdf
    • https://uploads.strikinglycdn.com/files/73da0a83-3d8b-42f2-a837-3a87077ea4c1/ruger_p89_disassembly_manual.pdf
    • https://uploads.strikinglycdn.com/files/aff18c1e-3b82-47c0-8cb1-23177bf6a4ad/vodixokiwesibe.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008509.bin
e3bfdc53c7d061792287ad737e98d16c75530aee2d559ee570067f7b3700d7f0
pdf-font-stream PDF embedded font (sfnt) at offset 0x8509 4972 bytes