Malicious PDF — malware analysis report

Static analysis result for SHA-256 623f575f5063cf2e…

MALICIOUS

PDF

77.3 KB Created: 2020-11-01 06:13:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: c65d41e5c3b34439f1630f8637919cb2 SHA-1: 059d1b04f730ac78d270b7533dd26512e8d51482 SHA-256: 623f575f5063cf2e2939e7ebb35f4b13c4626a32bf3072830fccd2c8432b8d9a
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to disposable hosting and redirector services, indicating a link farm or SEO manipulation tactic. One critical heuristic identified a link to known malicious redirector infrastructure. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to redirect the user to malicious content, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=yarichin+b+club+plot In PDF document text
    • https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/potakoti.pdfIn PDF document text
    • https://biwireteput.weebly.com/uploads/1/3/4/1/134131636/tuvajaloxek.pdfIn PDF document text
    • https://buliduxefexefux.weebly.com/uploads/1/3/1/6/131636978/0df31b9.pdfIn PDF document text
    • https://gifedoku.weebly.com/uploads/1/3/4/2/134234788/bigajozemexolane.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421637/normal_5f9d1a7bd89ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386606/normal_5f91772246266.pdfIn PDF document text
    • https://rinedasufuketon.weebly.com/uploads/1/3/4/3/134340565/130b59d385af1c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374980/normal_5f95697e33c8f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d404305-2542-4315-a17d-8be17780210e/55895843092.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa25a3e6-f4a2-4a60-9c91-f5766acbce40/60267260507.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d529728-017f-49b4-bd97-27d2ccdb5957/hkmet_kadn_1_indir_mobil.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/0039/2603/files/jidazasola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38b672f9-c099-4b7b-9e86-a639a172354c/jawiwafaluzexire.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/4996/5985/files/70845088657.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c86979dd-78ec-477c-bae4-51c9e107a1d7/foo_fighter_torrents.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off00011457.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11457 6680 bytes
SHA-256: 00e03e0a7eb9bea903e9ee8f1d31313d35554e27a63c6559f1ae25c5cf567e84
font_00_sfnt_off00006fd4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6FD4 21108 bytes
SHA-256: 548fb5662911d356635ff1eb22d06b8081ef1386fea2ae25e8e83f72576135af
font_01_sfnt_off0000b35a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB35A 4944 bytes
SHA-256: 46de2aac7e5b7b84841b066bc745915573bfd1c3458298a56c1cb2e4c8c6c3a4
font_02_sfnt_off0000c41c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC41C 1604 bytes
SHA-256: 66ae9cb93707a09ee98d5acf47872a3fa39da0f44ff38891486dcce053eb019f
font_03_sfnt_off0000cc48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC48 12604 bytes
SHA-256: 16a1d399a92b193cf303a8b8e87e1a158d6f011f08bb3e51d916a58859215656
font_04_sfnt_off0000f57a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF57A 19200 bytes
SHA-256: 84566000bc22ff83a7c90b016a2ea44e3dfe55031d75c0a824cf96614a8e866d

Open this report in the interactive analyzer, or submit your own file for analysis.