Malicious PDF — malware analysis report

Static analysis result for SHA-256 82609663fc8a2a55…

MALICIOUS

PDF

55.6 KB Created: 2020-11-02 15:42:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: f16cc29977c2c39d6ed6d8adfc632c3d SHA-1: cb1b6d31d86a64fa14028b270683c9c5c97b3a3a SHA-256: 82609663fc8a2a55550701c87f75a51730b06fdd13f178e88598614deb895ad8
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document is classified as malicious due to its extensive use of embedded links, many of which point to known malicious redirector infrastructure or are part of a link farm. The document body, though partially obfuscated, contains a URL that is also flagged as a malicious redirector. The ML classifier strongly supports the malicious verdict, indicating a high likelihood of user redirection to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=definition+of+demographic+momentum+ap+human In PDF document text
    • https://xitofubipu.weebly.com/uploads/1/3/4/3/134375163/zuporabifugakolit.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365539/normal_5f9161a6f3d73.pdfIn PDF document text
    • https://gufobigan.weebly.com/uploads/1/3/4/4/134481927/vogifufujaxuvopex.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407062/normal_5f9e2af7d9fb7.pdfIn PDF document text
    • https://xijonezamo.weebly.com/uploads/1/3/1/4/131407630/6562068.pdfIn PDF document text
    • https://titumakusijuvap.weebly.com/uploads/1/3/4/3/134353199/8234089.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378852/normal_5f8a8a1b60dd8.pdfIn PDF document text
    • https://jikiwifapa.weebly.com/uploads/1/3/4/3/134338998/e364cc68ea3f0c.pdfIn PDF document text
    • https://jamafijuzu.weebly.com/uploads/1/3/1/4/131437216/9664319.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/6574/4801/files/velet.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/70940861252.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0507/3112/2843/files/bonefa.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/0429/7375/files/rebojaxunife.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0504/6540/7136/files/diripemejulakopibujome.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C47 6408 bytes
SHA-256: b71bf7faf3a2ce2315c75c81a6c499eeb463499f5945c9b99d2f9af5b1770855
font_01_sfnt_off00007c13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C13 5356 bytes
SHA-256: 0e97e6d4542f69e3d5bb8a9c7d978a774be0e7ef7ba3a15d7fb23bfa02ffaaab
font_02_sfnt_off00008e29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E29 2212 bytes
SHA-256: b46b845eeebf342888160e446f93ba433a309431cbe71a6b97273c5237a38f65
font_03_sfnt_off00009842.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9842 10164 bytes
SHA-256: 215874b7784df6ea135be19299d0c1a6059d787530416843ed7fed10096ea42d
font_04_sfnt_off0000bb75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB75 16036 bytes
SHA-256: 35d3440dae1ebc896564e4e6f70ea95aa3a30a1ac603c7fffbb21b68b8b72e2f

Open this report in the interactive analyzer, or submit your own file for analysis.