PDF malware analysis — malicious · 28fb05430fcb933e

MALICIOUS

PDF

44.1 KB Created: 2020-10-26 23:20:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 0d0960b3b19575c2d786f0d4b5d173b7 SHA-1: 4c039a296001436c928046fb103dec0ae49785a6 SHA-256: 28fb05430fcb933ee696cecf4b6bbead3b378ce12d33e0589fe2add2aad88980

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the URL which is presented in a way that suggests a lure, likely for phishing or malware delivery. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/123?keyword=no+longer+at+ease+chinua+achebe+audiobook In PDF document text
- https://cdn-cms.f-static.net/uploads/4369190/normal_5f8a4ed8a3a96.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365570/normal_5f8dfb334b09e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378383/normal_5f8b7f58cb593.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379237/normal_5f9354eae8845.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366309/normal_5f8f8b023a380.pdfIn PDF document text
- https://kurikezexiwu.weebly.com/uploads/1/3/0/7/130775092/f2d4bbfcbfa.pdfIn PDF document text
- https://malinozibide.weebly.com/uploads/1/3/4/3/134380659/47e249160f0c579.pdfIn PDF document text
- https://lupolaluxu.weebly.com/uploads/1/3/2/6/132681144/7dbf552e2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f8b304d8835a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379841/normal_5f95d65d73ade.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4406775/normal_5f935c45a89a4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371247/normal_5f90dbf8d1456.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367925/normal_5f9132244759d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d6faf26c-c25f-4a2b-8f9b-a489701cb130/61902526907.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6eebab7e-18ba-41b7-ac8b-3637d5543b47/papokexexi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71477460-1659-4ec8-915f-032d0a43a4f3/la_chvre_de_monsieur_seguin_ce2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a6b2e2c1-6ad1-4551-814c-e79d7c404608/biwegafepe.pdfIn PDF document text
- https://s3.amazonaws.com/kagedatabujo/libro_adrian_paenza.pdfIn PDF document text
- https://s3.amazonaws.com/besafefaf/17999808828.pdfIn PDF document text
- https://s3.amazonaws.com/lanorolowu/14124426804.pdfIn PDF document text
- https://s3.amazonaws.com/wexukufedepim/oxford_collocation_dictionary.pdfIn PDF document text
- https://s3.amazonaws.com/pazifetanegapu/blue_eyes_song_lyrics_download.pdfIn PDF document text
- https://s3.amazonaws.com/mejawiwomak/apparel_business_plan.pdfIn PDF document text
- https://s3.amazonaws.com/kavitokolezub/40415034806.pdfIn PDF document text
- https://s3.amazonaws.com/mijedusovineti/chlamydia_pneumoniae.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005472.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5472	5376 bytes
SHA-256: `881116b24e9d28fc5255dfe029b8815b66df06e68ece4b2166a122b024f77840`
`font_01_sfnt_off000066a6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66A6	11176 bytes
SHA-256: `86863ad73c5c472928ffc728c1dad97866f32e76e1ba97c7b83cf1646c87ead8`
`font_02_sfnt_off00008c16.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C16	16448 bytes
SHA-256: `bc6d684f813ac1c32be8bd0fe15b7813cdddcd900b6f98dcbbe4bb93017ec79b`

Open this report in the interactive analyzer, or submit your own file for analysis.