Malicious PDF — malware analysis report

Static analysis result for SHA-256 4303ecb0f59d4c20…

MALICIOUS

PDF

35.4 KB Created: 2020-10-07 00:29:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 5ec7776f1530181b9be2a92594b48262 SHA-1: 2e37bcb68db97d4df2b81bb1691748615216c899 SHA-256: 4303ecb0f59d4c20905b796b6d2528a97fce8b618fa95b7cafc59317dff4e5b8
152 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded links, with one specifically identified as a malicious redirector. The ML classifier also strongly indicated maliciousness. The presence of a link farm suggests an attempt to artificially inflate search engine rankings or distribute malicious content. No scripts were extracted, but the embedded links are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=analyse+le+pont+mirabeau In PDF document text
    • http://files.1-body.org/uploads/1/3/0/7/130738822/7120303.pdfIn PDF document text
    • http://jidakizu.judgeduber.com/uploads/1/3/1/6/131606228/0e0e902f1a.pdfIn PDF document text
    • http://files.nextlevelbasketball419.com/uploads/1/3/1/0/131069899/ae0d199bd5a3.pdfIn PDF document text
    • http://files.myredbarnmedia.com/uploads/1/3/1/4/131453496/739ff2abe41da48.pdfIn PDF document text
    • http://files.baconbuttr.com/uploads/1/3/1/4/131436997/wotozeduko_guxowabatijuzan_powajirinuze.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfd2aa8a-8bfb-44a6-930e-0dd5cd7819c1/bubagirolabowetafoki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/927073bd-0078-40cf-b725-9c20f4ebd390/46507453749.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4da0e73b-25da-4390-bd97-83afa1571f02/pufaranas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2c18108-6a47-425e-9467-a0aba81bdb0d/73682480487.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/3674/0264/files/ashley_furniture_baby_dressers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0813/0213/files/silver_fox_men.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/071c4162-23ab-4eef-bedc-1ee75f164051/77714384300.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b183c8a0-1e27-4648-b48b-d1df34c0f8ac/xevitawobodes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76e299ec-8355-4d95-b9e3-96acafa2b872/ruxosifevix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/726c8eb7-6d5f-4534-bf14-fda3e123c04f/5942413871.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/810e9c3a-80f9-415b-be76-1bd798baf27c/14243728315.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007dcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7DCD 5196 bytes
SHA-256: 5277b832de90f1b49c41855203fff372dec607eb4339c8f7f4a479d643e89409

Open this report in the interactive analyzer, or submit your own file for analysis.