Malicious PDF — malware analysis report

Static analysis result for SHA-256 578e25f803a1e115…

MALICIOUS

PDF

47.8 KB Created: 2020-10-20 13:50:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 56c0dfca8c64f891d1f9b1ec34c27a32 SHA-1: e4db2dd2d68f6dae27bd2b603db6a5ddd8a4e881 SHA-256: 578e25f803a1e115e56973219552bd76e1df0056e56e55297cf402b271890d36
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that redirect to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains a URL that appears to be a lure for a camera app, likely intended to trick the user into clicking. The presence of numerous external PDF links also suggests a link farm or redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=medium+format+camera+app+android In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369499/normal_5f88c6d3b4150.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365607/normal_5f870bec297ec.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/0c71827c-aed3-4144-a062-08d0d513fc98/wurozilozo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55cf2049-0d15-46d4-a45b-bb76607d92e2/11056274867.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7ef534f-e8a5-4600-b880-9d4e8938e9ed/jawudomog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a15956f5-d12e-459c-b595-8cd280dc8ea1/43358072308.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/838f6a70-c63e-4e42-9a71-8a348f9995dd/nibajewojafoza.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0469/0070/7488/files/wonujadazika.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/2412/9441/files/90322688176.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/7692/7134/files/unr_campus_map.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/9101/5842/files/fallout_2_sniper_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/2036/9576/files/57058759606.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0314/9479/files/97772786451.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/3686/8762/files/vananewimufewagu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd0a4378-cd5f-4a81-90e9-dbc8fbdc2ff3/25463348161.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68d06de4-cae1-4f73-bd48-4ad1ed291710/darubenebewonuruzuxigero.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39b42364-bd9f-4d5b-8ea1-2b975a40b42c/i_used_human_toothpaste_on_my_dog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4cf7caf2-8dcc-4db8-bdea-94852ef7175a/4101520923.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d07914b-c299-4b3e-b8b1-197f1a12f477/97912084804.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c417b6e9-ee18-43b4-9c42-f35613a10d8f/kazunolumiwukava.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab3671d3-ea38-4b3e-a42d-4928a859b57a/batitiko.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E25 4980 bytes
SHA-256: b2df993cceab6faa9966744a43eb4570fe1d026875abc83e84c5c30b32cfc887
font_01_sfnt_off00007efa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EFA 10608 bytes
SHA-256: f42106241575fc0b5d2c44ddd766f776751133a70bacf9de0a01be9daa4b0aaa
font_02_sfnt_off0000a346.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA346 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.