Malicious PDF — malware analysis report

Static analysis result for SHA-256 49284a7664a7c794…

MALICIOUS

PDF

43.1 KB Created: 2020-10-07 05:24:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 90e08ec5e1e428f149f6e77869ee09a2 SHA-1: 31bee3a398b1f1d5439ed0fd9ac2f56bb3225ac4 SHA-256: 49284a7664a7c79485b29e6836430ab4006945a29247a24276d6ae0932e5ffa2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The document body, though obfuscated, contains URLs that are likely part of a link farm or phishing campaign. The ML classifier strongly indicated maliciousness, supporting the conclusion that this file is designed to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/pify?keyword=navy+chief+petty+officer+mission+vision+and+guiding+principles In PDF document text
    • https://site-1037164.mozfiles.com/files/1037164/21475265104.pdfIn PDF document text
    • https://site-1039390.mozfiles.com/files/1039390/jimelibekuxiwotef.pdfIn PDF document text
    • https://site-1037022.mozfiles.com/files/1037022/25273919763.pdfIn PDF document text
    • https://site-1038815.mozfiles.com/files/1038815/wotej.pdfIn PDF document text
    • http://files.trinitywellnesskc.com/uploads/1/3/1/6/131606133/3431123.pdfIn PDF document text
    • http://files.sunburstmusic.org/uploads/1/3/1/3/131383453/1802692.pdfIn PDF document text
    • http://files.mclennancostume.com/uploads/1/3/0/8/130814605/6519575.pdfIn PDF document text
    • http://defuw.notredameberlinseminar.org/uploads/1/3/1/6/131636627/vosesikikute-nesurizoxu-pikazapekamitow.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/1391/7856/files/tejusopimebup.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/3665/7822/files/words_that_start_with_int.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/9094/3901/files/37580285738.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/1972/2152/files/multiple_discord_accounts_mobile.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/0375/6191/files/sopapilla_cheesecake_dessert_allrecipes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006921.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6921 5700 bytes
SHA-256: c692926ddf52a7a78322bb1a3dfd3c3135b9da9d021a5881db53cd1e435f510b
font_01_sfnt_off00007c7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C7B 10192 bytes
SHA-256: e1421f605da73cf253ffd7de3a3d644ddae7169d594ba23fc1f7dcf1722599ee

Open this report in the interactive analyzer, or submit your own file for analysis.