Malicious PDF — malware analysis report

Static analysis result for SHA-256 75b4180f3df1818f…

MALICIOUS

PDF

56.0 KB Created: 2020-10-12 22:19:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: bc880b65cf3de0f9492d72f0f87adf5a SHA-1: 2cc5c2266eb94588ca7bc75cfca93626ffe4d2f2 SHA-256: 75b4180f3df1818fc7e4b39f31ae0949722e99df9e8bb0a7ec85b2f210192b73
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with one identified as a malicious redirector. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains URLs that are likely part of a link farm or SEO poisoning campaign designed to lure users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=%25D8%25B4%25D8%25B1%25D8%25AD+%25D9%2585%25D8%25B9%25D8%25B1%25D9%2581%25D8%25A9+%25D8%25B9%25D9%2584%25D9%2588%25D9%2585+%25D8%25A7%25D9%2584%25D8%25AD%25D8%25AF%25D9%258A%25D8%25AB+pdf In PDF document text
    • https://site-1043608.mozfiles.com/files/1043608/wanowexunisarer.pdfIn PDF document text
    • https://site-1042734.mozfiles.com/files/1042734/zebinurufojuxokovez.pdfIn PDF document text
    • https://site-1036851.mozfiles.com/files/1036851/38337681684.pdfIn PDF document text
    • https://site-1037175.mozfiles.com/files/1037175/topukowov.pdfIn PDF document text
    • http://files.dianeweinerauthor.com/uploads/1/3/1/8/131856754/simejaju_gowaxod_jakotaro.pdfIn PDF document text
    • http://files.clarkredangus.com/uploads/1/3/1/3/131381078/bajinebopu.pdfIn PDF document text
    • http://pekefewaf.learningslowly.co/uploads/1/3/1/3/131379373/2a0093fe.pdfIn PDF document text
    • http://fokexa.mapclimatechange.ca/uploads/1/3/1/4/131437423/cae9f.pdfIn PDF document text
    • http://files.ocampr.org/uploads/1/3/1/4/131437865/b87f9a5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/7562/4355/files/pills_n_potions_lyrics_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/8661/8017/files/calla_lily_meaning_death.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/7333/1899/files/85967938126.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/7813/9035/files/55444967534.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/8090/8954/files/norris_and_stevens_rentals.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/5008/1690/files/47549393177.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/5842/9089/files/halo_2_strategy_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/3809/6546/files/humility_true_greatness_by_c.j._mahaney.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off00009d7f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9D7F 28300 bytes
SHA-256: a29b2b9227fecfb25d79337f11ff9e7e9218f1413cf45e4148d096767d913489
font_00_sfnt_off00004ef7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4EF7 4424 bytes
SHA-256: 66b058b419c059225cc5f5947c93d2ac0cca3778a5e1cea1ec37c37e5a4406d5
font_01_sfnt_off00005e16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E16 1648 bytes
SHA-256: 71ed7777df633bcdafb221e4b97748f029842b21a6b539cbd3a2681e07eb4123
font_02_sfnt_off00006658.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6658 18164 bytes
SHA-256: f467b37b70eae691e1311bfc45fd049cdb6e961d5c25c384cce807cc5c8e34be
font_03_sfnt_off000082c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82C4 7772 bytes
SHA-256: dfc6c405c1f7fa01990e491d28c372ee0518d21c07f28bd885a2109c36d0e825

Open this report in the interactive analyzer, or submit your own file for analysis.