Malicious PDF — malware analysis report

Static analysis result for SHA-256 4268fdc1edfb954a…

MALICIOUS

PDF

43.6 KB Created: 2020-10-26 03:25:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5cfc59c76d33cbd9675599222ed1b2d5 SHA-1: 747e2e9a7aa3127b042bf405ecc4149879b6bbfb SHA-256: 4268fdc1edfb954a4efda5205f06f6e58b69248ef9f636a8550f8124ed1b5a89
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded links, many of which point to external resources, including a known malicious redirector. The document body, though heavily obfuscated, contains a URL that appears to be part of a link farm designed to attract users searching for popular content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=best+live+cricket+streaming+apps+for+android
    • https://kuwofepex.weebly.com/uploads/1/3/2/7/132740654/3375228.pdf
    • https://wuvirinofibugiz.weebly.com/uploads/1/3/1/0/131070402/nodomiw_ditikerox_sixodipigoda_tupujolapaponog.pdf
    • https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/dec838bc8.pdf
    • https://kugixixubeleji.weebly.com/uploads/1/3/4/3/134324677/5235078.pdf
    • https://rulomegujenuguv.weebly.com/uploads/1/3/4/3/134329868/zibika.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pazifetanegapu/al_quran_bangla_darussalam.pdf
    • https://s3.amazonaws.com/fezenur/78180291454.pdf
    • https://s3.amazonaws.com/dobesogum/63792281847.pdf
    • https://uploads.strikinglycdn.com/files/badffee1-89d4-4c0e-93c1-6dfe7cf2dd85/ginodibe.pdf
    • https://s3.amazonaws.com/lijulijowivaze/the_authoritarian_personality.pdf
    • https://s3.amazonaws.com/xunilukegez/5722098191.pdf
    • https://uploads.strikinglycdn.com/files/1e00f3dc-44e0-47c7-8561-1f5f5f815cf6/mowuwuwojirurasuliguwa.pdf
    • https://uploads.strikinglycdn.com/files/d0978446-72d3-4611-b311-027a2a13560d/29539382833.pdf
    • https://uploads.strikinglycdn.com/files/f28cd1b7-925b-4eca-9303-c77a43e4d855/cuisinart_convection_bread_maker_recipes.pdf
    • https://s3.amazonaws.com/bokofapig/9163867867.pdf
    • https://s3.amazonaws.com/divexikav/bordeaux_mixture_preparation.pdf
    • https://s3.amazonaws.com/vatosolikijike/ciencias_forenses.pdf
    • https://s3.amazonaws.com/sevoga/fefoketigi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000699e.bin
24d6c361714d692022b9fd86f980457fc312ede014ff359d4be500458e91650e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x699E 5648 bytes
font_01_sfnt_off00007ccb.bin
983f680a9c02f9a9aa81b79b73c4fbb1a5986c3eb50d0c47d2ee2c335e14941b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CCB 10640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.