Malicious PDF — malware analysis report

Static analysis result for SHA-256 52895d1fb0e9fd5d…

MALICIOUS

PDF

37.5 KB Created: 2020-10-31 02:33:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 8f7ae4734f4223d57b4b641649630612 SHA-1: ea31e4f9b8faa8889ea5951f282fc14f9dcbf29f SHA-256: 52895d1fb0e9fd5d3fcaf9f249bcaa2454a303fcf80b6ed230eb18c108b59435
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with one identified as a malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'PDF_SEO_LINK_FARM' indicate a strong likelihood of this document being used to lure users to malicious sites. The ML classifier also flagged this PDF with high confidence. No scripts were extracted, but the document body contains URLs that are likely intended to be clicked.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=show+low+library In PDF document text
    • https://kufazijofiw.weebly.com/uploads/1/3/0/7/130776126/3776894.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381297/normal_5f92efe823ac1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376866/normal_5f8b9422c7d5e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376598/normal_5f907b657e4a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416304/normal_5f9bea6ed7a2a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366366/normal_5f87a98bc6796.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b7e340f-df36-4893-88dd-85c4ce91fa94/emoji_for_star_wars.pdfIn PDF document text
    • https://s3.amazonaws.com/donake/tabakozowigimok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/529fc092-0cd2-4560-8238-edc386536858/45925330824.pdfIn PDF document text
    • https://s3.amazonaws.com/damerirazib/adjective_forming_suffixes_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/davawina/cambridge_igcse_mathematics_core_practice_book.pdfIn PDF document text
    • https://s3.amazonaws.com/susopuzupure/application_for_child_care_leave_form.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005496.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5496 5032 bytes
SHA-256: ed847c6f6684740d50afd3f4302a4fb209ec535f27b7c180acba9fb4d7bee8bf
font_01_sfnt_off000065c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65C4 10520 bytes
SHA-256: 7cd1a220c412e0bdff216201806a56ebd7850a5e6ddb70ff93ef1b7eb7613587

Open this report in the interactive analyzer, or submit your own file for analysis.