Malicious PDF — malware analysis report

Static analysis result for SHA-256 74a6f7c30a127da9…

MALICIOUS

PDF

42.5 KB Created: 2020-10-31 11:58:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 3b9c47dde3db9285220aca34666c8786 SHA-1: 7e008dae40ab47609dbd3cc26a125cc97717cc1e SHA-256: 74a6f7c30a127da9dbde067355335c8ff76c25badbebe2a218878a53fa34a9c8
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one specifically identified as a malicious redirector. The document body, though obfuscated, contains text related to scholarships and the malicious URL, suggesting a lure to trick users into clicking the link. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=hsf+scholarship+2020+reddit In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/692092ea-b117-414a-9e9d-477b02651f1a/80321279895.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05fbd642-dc29-4a2f-b8fd-13205723c649/lakafiwedizuzati.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/5108/0087/files/95031079639.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11a5fb42-c260-4dad-8591-5d143725bdf4/sekorile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f9779f9-8224-4372-9eb0-624876a62f52/98700912345.pdfIn PDF document text
    • https://s3.amazonaws.com/lewuli/oil_for_honda_generator_3000.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62e9b2d4-39de-4e44-a648-015f8fdc6885/sutizakabalivelamewov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bc95dbb-80aa-4542-99ff-5e19ad0c4697/xetizedutagu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc9fda43-68fa-4533-9fbf-2e39f2cc1845/the_little_seagull_handbook_3rd_edition_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1318f0b5-5574-4fc5-8a15-d38db7e1d01a/sipovasetesadojow.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/1762/3957/files/cypress_and_grove_brewery_gainesville_florida.pdfIn PDF document text
    • https://s3.amazonaws.com/somamere/82116484551.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65A8 5476 bytes
SHA-256: ce3117574c40996a42ed73f6186e48afca61e7a3144bbb0ece987fc4c4f4d03f
font_01_sfnt_off00007847.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7847 10900 bytes
SHA-256: bdd2f9692cf0a2ec7a6a752ca5353a53054812f110603c2c5431683993a260cf

Open this report in the interactive analyzer, or submit your own file for analysis.