Malicious PDF — malware analysis report

Static analysis result for SHA-256 62459547e0f42d39…

MALICIOUS

PDF

41.7 KB Created: 2020-11-02 23:58:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 038f848ef9ff06ab4550d29f694db7c3 SHA-1: 1dc147dbe0b3c9a518dc555030fc83cce2e6f570 SHA-256: 62459547e0f42d394dd5a1fa0fb819fe45679cfc8686b8e640f46e3a78e925fb
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF contains a large number of embedded links, with at least one identified as a malicious redirector. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, suggesting an attempt to manipulate search engine results or distribute malicious content. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the extensive link farm points to a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/123?keyword=dynatrap+dt2000xl+1+acre+insect+trap In PDF document text
    • https://tubenuluni.weebly.com/uploads/1/3/1/4/131437864/vuragana.pdfIn PDF document text
    • https://nibojesuko.weebly.com/uploads/1/3/4/3/134329062/4400453.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403143/normal_5f9500465c8e0.pdfIn PDF document text
    • https://jasazifo.weebly.com/uploads/1/3/1/4/131437377/4480974.pdfIn PDF document text
    • https://dagigokes.weebly.com/uploads/1/3/0/7/130739756/xaxepeson.pdfIn PDF document text
    • https://tezadogiva.weebly.com/uploads/1/3/4/5/134522012/14f4b0cd6.pdfIn PDF document text
    • https://dowazulipogopu.weebly.com/uploads/1/3/4/3/134322731/goxajisitugaburon.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411489/normal_5f95e7bc62d63.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f671dbce-cdd5-473e-8fe5-90f20f5d9c5d/40153255705.pdfIn PDF document text
    • https://s3.amazonaws.com/tujeviwakirawu/413754304.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1ca92e0-24ac-4f76-bc63-b224974020a0/jabenimegiduvusijikadona.pdfIn PDF document text
    • https://s3.amazonaws.com/xisefowu/sexarepinijawa.pdfIn PDF document text
    • https://s3.amazonaws.com/dugibabafod/fulekidarumokomabug.pdfIn PDF document text
    • https://s3.amazonaws.com/zazelujeju/20x20_coordinate_plane.pdfIn PDF document text
    • https://s3.amazonaws.com/wibadinavosunom/algorithms_in_a_nutshell_2nd.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62A6 5564 bytes
SHA-256: ef8f95c033f7e639a3b5862131b45a4a53b9f37b302a295188d25e9a355f3aab
font_01_sfnt_off000075bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75BB 10696 bytes
SHA-256: f2d375321cda9a39902ed5447c412cf05553e64c607b3ad37d930f5d14fdf185

Open this report in the interactive analyzer, or submit your own file for analysis.