Malicious PDF — malware analysis report

Static analysis result for SHA-256 40ae5696fb543827…

MALICIOUS

PDF

42.1 KB Created: 2020-10-25 10:16:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 9b6f8e0a112724086f91b86e06515ac5 SHA-1: d3ff80ce2b774f41fbe9e645a5cfbe7c7519725a SHA-256: 40ae5696fb543827ae5475c790f23fb23aadcc0a6a1e29838e5058cc282b5cac
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that redirect to malicious infrastructure, specifically a URL related to 'kl gangster full movie 2'. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms this, and the ML classifier also flagged the document as malicious. The document body and embedded link structures suggest a phishing or scam attempt to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=kl+gangster+full+movie+2 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369518/normal_5f886c9ba818c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371809/normal_5f8d15c39804f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365634/normal_5f89276a4c8ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390323/normal_5f917d797ece4.pdfIn PDF document text
    • https://kakawugob.weebly.com/uploads/1/3/0/9/130969990/4518770.pdfIn PDF document text
    • https://sabadefupi.weebly.com/uploads/1/3/4/3/134345863/tukepurejagesif-wujevogelexonad.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/98202080150.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/english_grammar_exercises_for_class_5.pdfIn PDF document text
    • https://s3.amazonaws.com/zonebon/60805665148.pdfIn PDF document text
    • https://s3.amazonaws.com/pizexopenaxu/tisaselus.pdfIn PDF document text
    • https://s3.amazonaws.com/remeranexe/bogimelonu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6afedca-de1c-4b30-955b-6ec597e629d7/zalekupajikodetexorizav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b585d84-4872-46aa-af99-84f7172aafda/kafideve.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/4863/9907/files/gibson_les_paul_deals.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/8935/4142/files/datofugosisoguda.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/9036/9942/files/38143727272.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/7561/5902/files/worksheet_add_name_vba.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0460/4048/1956/files/tofetovunoloziruzosu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63F4 5248 bytes
SHA-256: 1dab21c77658921be1b76fb02fa6771b783d128e47c69a7cfdd80fa2f600c550
font_01_sfnt_off000075cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75CC 10948 bytes
SHA-256: 46164b50b78c621fc83d7266a60f3e1850d42fbe4dcef2a276390f654afda8f8

Open this report in the interactive analyzer, or submit your own file for analysis.