Malicious PDF — malware analysis report

Static analysis result for SHA-256 648393702d21a5a6…

MALICIOUS

PDF

42.9 KB Created: 2020-11-07 23:37:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 970da45f577b9f7a553ab8058dd94e1f SHA-1: 2d8d3002085f5a65e1b91c5d255b7190c806efc4 SHA-256: 648393702d21a5a6dc1150fd5a8a1213620a97476e9d99602a84ee022db0c05a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded links, with a primary URL pointing to a site offering Minecraft mods, suggesting a deceptive lure. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, likely for SEO manipulation or to distribute malicious content. While no scripts were directly extracted, the PDF structure and embedded links are indicative of a phishing or malicious redirection attempt, potentially using JavaScript for obfuscation or further actions.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?keyword=weapons+mods+for+minecraft+1.6.4
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e6739741-e8e0-4d17-a48d-3b13623155f8/letter_m_worksheets_preschool.pdf
    • https://uploads.strikinglycdn.com/files/5429ce30-4145-48ec-8fe8-ba7f061c8b32/pariwiwazelirebat.pdf
    • https://s3.amazonaws.com/tumasun/39474002045.pdf
    • https://uploads.strikinglycdn.com/files/343a0278-cafa-4433-8295-903cfc85e242/3.pdf
    • https://kedijabu.files.wordpress.com/2020/11/jinojulukugogonole.pdf
    • https://jororox.files.wordpress.com/2020/11/67529088064.pdf
    • https://lusolewipeso.files.wordpress.com/2020/11/98265057697.pdf
    • https://piwidek.files.wordpress.com/2020/11/folonadiseletegewut.pdf
    • https://uploads.strikinglycdn.com/files/e10a595d-edf5-4cd3-add8-1b1d3c5b5ee7/dejidagonukesozadiduva.pdf
    • https://s3.amazonaws.com/wazorixekunafob/formal_email_writing_rules.pdf
    • https://uploads.strikinglycdn.com/files/911c68a6-2368-48d4-a85a-210f0c5e7797/akuma_no_riddle_op_download.pdf
    • https://janavevuxan.files.wordpress.com/2020/11/vudoneg.pdf
    • https://uploads.strikinglycdn.com/files/dfd8088a-9356-4bc5-ab6e-2bcff25e04e1/362832618.pdf
    • https://uploads.strikinglycdn.com/files/48314eb7-5e0f-41af-9109-d22d728a345b/tozilebo.pdf
    • https://vobifex.files.wordpress.com/2020/11/97995462246.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000501e.bin
3b0af09bf43b888d49bd6042f12747b946bfff5af5beb52a2cfa9db06941d7e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x501E 5608 bytes
font_01_sfnt_off00006338.bin
f8de648c3a5e0b2e2483077b91b9e0a86bc174fc4127132772dcc0e4f8d66133		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6338 11920 bytes
font_02_sfnt_off000089ed.bin
6f41d85279102efce3c4bd26fddb767baf9b68a4f55e239fba9bedc2a2d3b953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x89ED 16064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.