Malicious PDF — malware analysis report

Static analysis result for SHA-256 28b986ea60c691a9…

MALICIOUS

PDF

61.6 KB Created: 2020-10-22 05:24:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: c4f91728735bfa80f74baeb116b72339 SHA-1: 8e5aa3baa4ea4dd79aa92a1cb2d4711d564a9ffe SHA-256: 28b986ea60c691a9541f05777922860c74b9cfa9dcfdc1857a18f810f0e81054
194 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a redirector URL, which is associated with SEO link farms and free download phishing lures. The document body, though heavily obfuscated, contains a URL that matches the redirector's keyword parameter, suggesting an attempt to trick users into downloading software. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=descargar+counter+strike+1.6+apk+para+android In PDF document text
    • https://jamafijuzu.weebly.com/uploads/1/3/1/4/131437216/0c512.pdfIn PDF document text
    • https://sifizebutu.weebly.com/uploads/1/3/0/8/130814914/7578434.pdfIn PDF document text
    • https://norumevi.weebly.com/uploads/1/3/0/9/130969469/390da6f8aad9ed.pdfIn PDF document text
    • https://winugemu.weebly.com/uploads/1/3/1/0/131070294/davad.pdfIn PDF document text
    • https://zulatikuwa.weebly.com/uploads/1/3/0/7/130776211/9673907.pdfIn PDF document text
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/a8401ec7a9859.pdfIn PDF document text
    • https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/55fd76ca118.pdfIn PDF document text
    • https://fakimodixoto.weebly.com/uploads/1/3/0/7/130739088/4918862.pdfIn PDF document text
    • https://dotofinadi.weebly.com/uploads/1/3/0/7/130740455/deluwomobimu.pdfIn PDF document text
    • https://jonukejunuxesa.weebly.com/uploads/1/3/1/4/131409236/9932608.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wilugugo/wasofajomenapa.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files/42631267738.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/bergey_s_manual_of_determinative_bacteriology_8th_edition_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/pilagu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/3591/7473/files/97811514348.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0467/8038/3385/files/magistrates_court_act_uganda.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/7550/9658/files/elements_and_their_properties_worksheet_answers_chapter_19_section_2.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/0225/7823/files/downgrade_android_8_to_7_htc_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/912cf912-3c68-4735-ac6e-a609a891c677/kelezerujigokikuzodume.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5a0b211-10ff-4c2a-9f83-31d395fd4063/peraketonera.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10637f71-570d-4e28-986f-146ce5631b5d/55762062832.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b938c7ef-5d52-48e6-a808-1d6792e26119/pekazulopalepa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/786aa5d3-0179-4db8-a3fe-6355c70954b6/lanapolofududufeweboxote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2ac99fb-6115-4957-b09d-822e31630fdf/84914868089.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98284b49-ce0b-4ba2-b278-96baf7513d98/marie-_pascale_elfman.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b299.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB299 5508 bytes
SHA-256: c98eed211accbd72a88502e6833d0751be4ec5174494cd97f808a778732b26a9
font_01_sfnt_off0000c56d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC56D 10212 bytes
SHA-256: 28e48c76bebf740194a0462db1fbbe8282152b41fd3b2e1aa7ad659fc99dce2b

Open this report in the interactive analyzer, or submit your own file for analysis.