Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bc8b218d0f88a4f…

MALICIOUS

PDF

52.4 KB Created: 2020-10-15 01:13:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: a5be30ab497e9ff4762968d51c9b0525 SHA-1: 774234d6b2c02766189de1b9efcd9f3b664ce80d SHA-256: 5bc8b218d0f88a4feda43d8fedcc0ac2852e1f63348276450912b82d18f01a3d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for a malicious redirector link, pointing to a URL that appears to be part of a link farm. The document body, though heavily obfuscated, contains the same URL, suggesting it's the primary lure. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/pify?keyword=buerger%2527s+disease+treatment+guidelines In PDF document text
    • https://site-1039929.mozfiles.com/files/1039929/vebedesifo.pdfIn PDF document text
    • https://site-1043928.mozfiles.com/files/1043928/properties_of_trapezoids_worksheet_math_aids.pdfIn PDF document text
    • https://site-1042010.mozfiles.com/files/1042010/whatsapp_new_version_apk_download_2020.pdfIn PDF document text
    • https://site-1041591.mozfiles.com/files/1041591/57542319093.pdfIn PDF document text
    • https://site-1037094.mozfiles.com/files/1037094/xomuwoxigalebagazitiwu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367645/normal_5f8767038c1b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367947/normal_5f876f08556be.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366027/normal_5f8766d4463ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365586/normal_5f86f61b935ce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367951/normal_5f8769c5e6732.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/de2456c2-c7af-4f5d-8f81-f3000989ee55/dodejokisubafivolekumip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27bd0f8a-ad17-4c1f-8a19-0a6f91e10b29/pikewejugodogosadev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62e66c1f-b6e3-4142-975f-707587288fd1/49147637131.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/505ea40a-4e20-4a53-a1eb-3b7fc7b3f9f3/dupisel.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/5662/5829/files/69234480129.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/6019/9069/files/island_castaway_apk_mod.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0488/1881/5141/files/oxo_food_mill_instructions.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/7872/4005/files/morse_taper_chart_in_mm.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/2011/4327/files/motorola_n136_bluetooth_headset_manual_free.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0478/0287/6063/files/dikominojitutokotakimida.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0481/7738/1543/files/53164473883.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/7000/0804/files/relational_leadership_theory.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/0891/3319/files/51112651397.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9412/3720/files/apartments_for_sale_in_logan_utah.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/5567/5552/files/native_american_games_xbox.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/8789/6480/files/babies_r_us_registry_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/4494/5051/files/92140968676.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/5453/0197/files/under_armour_coupon_2015.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/3896/0547/files/xetebumalatumexeguvum.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008b79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B79 5228 bytes
SHA-256: 6de7a41edc1e4ff5b8036cdf67a9c06e1dc04015018c928366eac34b0f6398d6
font_01_sfnt_off00009d2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9D2F 11296 bytes
SHA-256: d4670c3388f25da0c343fa34da7e818d97ff455bd5c3e9d3402c0502fc92107a

Open this report in the interactive analyzer, or submit your own file for analysis.