Malicious PDF — malware analysis report

Static analysis result for SHA-256 6779c129560497c6…

MALICIOUS

PDF

33.6 KB Created: 2020-11-06 19:01:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 655abe7e6a7b5becea7820a9b73e5eaa SHA-1: a9a49a197aa5a32dc59d7b6f30556c51c2577f69 SHA-256: 6779c129560497c62f1c7b7d30fec2fb4e97fbe0cbcdcd2b7a4d70d555b2a7e1
182 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded links, many pointing to disposable hosting, designed to create a link farm. One of the primary links directs to a known malicious redirector infrastructure, suggesting an attempt to lead users to malicious content or phishing sites. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=falchion+knife+csgo+price In PDF document text
    • https://sakukavazu.weebly.com/uploads/1/3/1/3/131379729/dbf85.pdfIn PDF document text
    • https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/kekifafonusidit.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424328/normal_5f9e3446726a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370072/normal_5f918d3578090.pdfIn PDF document text
    • https://tisatazufewuvo.weebly.com/uploads/1/3/1/1/131163687/ba81ee4c96405c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://mafaxivovel.files.wordpress.com/2020/11/7346655750.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14ebad89-c76b-48a3-8f4b-bbf1e7c62d48/puntos_suspensivos_piso_21.pdfIn PDF document text
    • https://wupolekofajo.files.wordpress.com/2020/11/21255405967.pdfIn PDF document text
    • https://subonurage.files.wordpress.com/2020/11/nawawejipivavujipopufijeg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45e8c7dc-d125-4d42-9586-337e6c9f0d5f/32759752767.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d980519c-14a1-4325-b5df-321282cbadd1/free_fortnite_accounts_ps4_with_rare_skins.pdfIn PDF document text
    • https://pazeden.files.wordpress.com/2020/11/86767518253.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61089c8d-ac30-4ad5-bf6b-2f82146d24c0/voicemail_app_android.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64B6 3028 bytes
SHA-256: 6435fc191ebc38e881df1ca8ecc095919b73462573e702801a286c4c05f9da51
font_01_sfnt_off00006f92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F92 5004 bytes
SHA-256: 97941d9c7b268c6c20fab2016bafec4c03454845874371dce8d3208d241b2f21

Open this report in the interactive analyzer, or submit your own file for analysis.