Malicious PDF — malware analysis report

Static analysis result for SHA-256 57eca48c953280e8…

MALICIOUS

PDF

45.9 KB Created: 2020-10-27 13:16:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0ae6b40c1f88865f9ac4e11f87fad6f2 SHA-1: d64fd0acb05b8c0e8a9b0b0d73d8af27c18db2f2 SHA-256: 57eca48c953280e85d46cd1da08d849d3fb03406e06b6cd26540501f6d7e6aa1
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating an attempt to lead the user to a harmful site. The document body, though heavily obfuscated, contains the same URL. The presence of numerous external PDF links suggests a link farm or SEO manipulation tactic, likely to obscure the malicious redirector.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=bu+dining+plans+apartments
    • https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/8759345.pdf
    • https://jufukakoxojopop.weebly.com/uploads/1/3/4/3/134317893/59b923f214068ac.pdf
    • https://noxepelobisuse.weebly.com/uploads/1/3/1/8/131871648/nisidunepodibowuxe.pdf
    • https://cdn-cms.f-static.net/uploads/4372360/normal_5f8b17d1acf24.pdf
    • https://cdn-cms.f-static.net/uploads/4369158/normal_5f8f68e30aeaf.pdf
    • https://towetebofipu.weebly.com/uploads/1/3/1/4/131437669/a0f544f.pdf
    • https://nuzopotox.weebly.com/uploads/1/3/4/4/134497293/jizalebijugoko.pdf
    • https://nijubalalo.weebly.com/uploads/1/3/1/4/131453980/5735079.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/dofuwexipe_ferutebis_zisulojil_nagonosut.pdf
    • https://kezopepeza.weebly.com/uploads/1/3/4/3/134332650/vadekulanala.pdf
    • http://mariestoryart.com/uploads/1/2/9/8/129801972/129801972.html?7
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5afc67b2-818d-4335-846d-90c97269773b/libro_de_hechizos.pdf
    • https://uploads.strikinglycdn.com/files/bc072254-a6f1-4c6d-ad08-28237e80bfec/como_se_llama_la_capital_de_honduras.pdf
    • https://uploads.strikinglycdn.com/files/175d6966-c59f-4699-9b97-f585ead12d1b/sopadadepumurizikaben.pdf
    • https://uploads.strikinglycdn.com/files/8e96631c-729b-4f57-9e77-d3cf5767751b/73250932787.pdf
    • https://uploads.strikinglycdn.com/files/f157df7f-3e9a-48ef-8c1e-3bbf787511e3/http_mariestoryart.com_uploads_1_2_9_8_129801972_129801972.html7_days_to_die_cement_mixer_location.pdf
    • https://uploads.strikinglycdn.com/files/67d97e36-aca7-460c-844a-867837edab99/porewuzatobowuveronus.pdf
    • https://uploads.strikinglycdn.com/files/67366c09-29cc-47ae-af71-8becf7f77d29/81666802288.pdf
    • https://uploads.strikinglycdn.com/files/27aeb9e1-2463-41a4-9e6d-2f6fec7a1dd3/dasug.pdf
    • https://uploads.strikinglycdn.com/files/5c81c87e-99e4-4eb4-8324-fe4738d3c6d0/tilomob.pdf
    • https://uploads.strikinglycdn.com/files/c3f50c16-4c82-444e-8975-e971a9edf1da/pokemon_emerald_unblocked.pdf
    • https://uploads.strikinglycdn.com/files/fdd35ace-85e4-440d-b522-27bc90e69782/ramemifiwefula.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000073fe.bin
ddfb9340bdf77b095ba726a758fc76ece27e2011e0fad6626cab96e262439b1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73FE 5328 bytes
font_01_sfnt_off000085fc.bin
cb6825e9c97ec4a3a7da4afc88c3242e95c0c72f63823945d5f6fb411bf6a10e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85FC 10612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.