Malicious PDF — malware analysis report

Static analysis result for SHA-256 350b64043a27fe35…

MALICIOUS

PDF

44.2 KB Created: 2020-10-15 20:24:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: c643a2d7d2fca28e38f4ad475d77163d SHA-1: 5670a28a95d9166ad4ec1887ef26ec1025c347f8 SHA-256: 350b64043a27fe35778d562712077abae1d1a30b4a1f53fbba7be4704e2674d6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links, many of which point to external resources. One of these links, 'https://ggtraff.ru/pify?keyword=jipmer+entrance+exam+paper+pdf', is identified as a malicious redirector. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, suggesting a tactic to artificially inflate search engine rankings or distribute malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/pify?keyword=jipmer+entrance+exam+paper+pdf In PDF document text
    • https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/8911912f5f58fde.pdfIn PDF document text
    • https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/8279037.pdfIn PDF document text
    • https://site-1041864.mozfiles.com/files/1041864/12548757920.pdfIn PDF document text
    • https://site-1043705.mozfiles.com/files/1043705/45520701692.pdfIn PDF document text
    • https://site-1040037.mozfiles.com/files/1040037/biletopab.pdfIn PDF document text
    • https://site-1036820.mozfiles.com/files/1036820/58093750424.pdfIn PDF document text
    • https://site-1037881.mozfiles.com/files/1037881/81123311689.pdfIn PDF document text
    • https://site-1040975.mozfiles.com/files/1040975/87765368243.pdfIn PDF document text
    • https://site-1038471.mozfiles.com/files/1038471/30730782770.pdfIn PDF document text
    • https://site-1038489.mozfiles.com/files/1038489/kujebutopige.pdfIn PDF document text
    • https://site-1044145.mozfiles.com/files/1044145/37372674110.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9776/0944/files/92356507553.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0427/6987/5111/files/69688219633.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/1819/8433/files/marejeguxupedizosaruloba.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/1810/7042/files/risawivekafetetibo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0504/2693/7494/files/wisifewikefotulizinufo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/2521/0263/files/11841054423.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0503/0726/8781/files/4595938955.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/3095/7208/files/town_hall_minecraft.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/0111/9398/files/the_hub_project_address.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c092858d-72ab-427b-bad3-ac1342b43135/99270071846.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c200edd5-ae21-4e0f-b33e-4f5340cb2b0e/51479618856.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36f46edf-ac6c-43a0-959b-6a6f412561f4/jifos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17589ffd-f534-41d8-805e-535c205349b9/satitezejutuw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F52 5148 bytes
SHA-256: 540e4fdfdfd26d7fd3d8f7d9dbc2d755bf4aab068f569841a46b78fa127b0624
font_01_sfnt_off000080b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80B6 10060 bytes
SHA-256: d2e58105b91531e4e9ded1e50369e5cb1177f8d380053460f61a7f0718a27cfb

Open this report in the interactive analyzer, or submit your own file for analysis.