Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f0ff2d98074da81…

MALICIOUS

PDF

49.9 KB Created: 2020-11-08 12:24:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 03a4a08cc3d6e9d9122a7ef51f072c91 SHA-1: 4a20f8c7e821f64ff164dfc5cb9b4934fd80823a SHA-256: 6f0ff2d98074da81112784d96eebf2c7d6be67b18be481301a8e7a3a1af87f13
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and a heuristic firing for a PDF link farm, indicating a likely SEO manipulation tactic. The document body, though heavily obfuscated, contains a URL that appears to be a lure for 'desktop wallpaper'. The presence of numerous external links, many pointing to benign files, suggests a coordinated effort to generate traffic or manipulate search engine rankings. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?keyword=desktop+wallpaper+1920x1080 PDF link annotation
    • https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/rasavef.pdfIn PDF document text
    • https://xovadesunuzavam.weebly.com/uploads/1/3/4/4/134479636/papovatu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://nekufinomo.files.wordpress.com/2020/11/planet_zoo_download_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c9779bc-9988-47a0-b200-c86bcf3880d6/nedigozujobuwun.pdfIn PDF document text
    • https://zatejoru847961968.files.wordpress.com/2020/11/72489844693.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd4879c9-c7cb-446a-ad02-9e40733f4f43/yamaha_rx_373_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdbafa9c-46d5-4a25-ae9c-083c475ac04c/code.org_unit_2_lesson_3_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a31d40d7-c47b-4c6d-8669-474d4b254d86/75676118103.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed7a4138-b19b-4d30-9c5d-a5273c8cd665/zudenadiwurof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/632704f1-3dcb-4157-8793-804611cf503d/rim_world_toxic_fallout.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/loneliness_depression_and_sociability_in_old_age.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e921a23d-ed93-4be2-9b20-2189b60ac0d0/descriptive_words_that_start_with_e_to_describe_a_person.pdfIn PDF document text
    • https://s3.amazonaws.com/jiwisigetizoxif/58180705075.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eec92b8e-e93d-442a-80d5-e8473a5f43fc/88255236947.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/818e7959-e7ec-41ae-ae52-d960b04c7bfc/98033544705.pdfIn PDF document text
    • https://xuxedoki.files.wordpress.com/2020/11/70786676526.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000082cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82CC 5712 bytes
SHA-256: 640c7640c14fe3f3c89c636c25de61b747073389e908f5c228933bc49c962e6f
font_01_sfnt_off0000966c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x966C 10444 bytes
SHA-256: bbfd212b8eb6c8ed4df20604d63b29d01020e7c4ef80cfb4090c22e1b1f97326

Open this report in the interactive analyzer, or submit your own file for analysis.