Malicious PDF — malware analysis report

Static analysis result for SHA-256 7430a9edcc7f19f8…

MALICIOUS

PDF

42.1 KB Created: 2020-11-09 17:03:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: ff7f527683fa3726c02ab59d8aed80fa SHA-1: 2f7390d64aa61196b9b1e120b4f08aa88436eb11 SHA-256: 7430a9edcc7f19f8cde773e75d7ad3cbc5dbd9cffb12ae07e926f6be70388197
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is designed to lead users to further malicious infrastructure. The document body, though heavily obfuscated, contains text related to 'Columbia county clerk ny recording fees' and a URL that appears to be a lure. The presence of numerous external PDF links suggests a link farm or SEO poisoning attempt to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=columbia+county+clerk+ny+recording+fees In PDF document text
    • https://bofunakepubosux.weebly.com/uploads/1/3/4/3/134371141/pijojisewigab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369926/normal_5f8ee6246fad7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372967/normal_5f8a01e0b53ee.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4b9483d-1c75-4707-96bc-9b3da24315a9/sibeb.pdfIn PDF document text
    • https://s3.amazonaws.com/kuboki/kunazimamupadabubepanumul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5abb94e1-2750-4228-b112-68bc09bc17f1/41334747303.pdfIn PDF document text
    • https://s3.amazonaws.com/zuguvoxoki/my_hero_academia_season_5_ep_1_dubbed.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99e4ffff-14f4-4856-89ba-6285f313dce4/taxofifosekalu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1aa7dd5-52b0-4fb1-9392-5e5a96b78162/92313904357.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ac7ec41-016a-41a6-bf28-594f531754f3/kiloboli.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f56d1c6-f67c-418c-a91c-183f7717c779/98872525261.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4516163-405e-4a71-b3b3-f5ee83d6b500/jojo_s_bizarre_adventure_ep_19.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000631f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x631F 5552 bytes
SHA-256: d80fa49978dc16f2275fcda8357604670adf52d8f0f8e873594a1152a7435298
font_01_sfnt_off000075f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75F1 11908 bytes
SHA-256: 924c471f7d445efe34ddc5cfbe807f4065bc4a182b9346bf39f80dc99db32f5a

Open this report in the interactive analyzer, or submit your own file for analysis.