Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ec9c1ee6645cc42…

MALICIOUS

PDF

34.7 KB Created: 2020-10-28 23:02:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aa27cbf040ed57e3eb6da216ba117168 SHA-1: 2887f2467065b29fb3e7616283d383fae08812a8 SHA-256: 8ec9c1ee6645cc42a8b132f4d38d12fcdc62416f57e14498b459e3e18cb48798
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded links, many of which point to known malicious redirectors or link farms. The document body, though heavily obfuscated, contains a URL that is also present in the heuristics as a malicious redirector. This suggests the primary purpose is to direct users to malicious infrastructure, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=conair+foot+spa+how+to+use
    • https://tegugozitofo.weebly.com/uploads/1/3/0/8/130874592/xowegejo-boxunulusilelig-liwogizowo.pdf
    • https://siveruvamavekug.weebly.com/uploads/1/3/4/2/134266289/4427893.pdf
    • https://cdn-cms.f-static.net/uploads/4392451/normal_5f967dc0d0fc9.pdf
    • https://luwobidope.weebly.com/uploads/1/3/0/8/130814225/navafiki.pdf
    • https://juragubiv.weebly.com/uploads/1/3/0/8/130874328/f895c9.pdf
    • https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/358210d4ddf3.pdf
    • https://jijalasigode.weebly.com/uploads/1/3/4/3/134344414/lijewexajojixaz_votevajage.pdf
    • https://cdn-cms.f-static.net/uploads/4368503/normal_5f8782f4982e1.pdf
    • https://mipirizu.weebly.com/uploads/1/3/2/6/132682564/pinumupoduzov.pdf
    • https://cdn-cms.f-static.net/uploads/4403674/normal_5f92689f5cd04.pdf
    • https://xasuvakem.weebly.com/uploads/1/3/4/4/134400919/fanixawijutojifezo.pdf
    • https://cdn-cms.f-static.net/uploads/4393911/normal_5f959ae18495b.pdf
    • https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/1e1d71.pdf
    • https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/2120396.pdf
    • https://cdn-cms.f-static.net/uploads/4367947/normal_5f9533c4636f4.pdf
    • https://samomalekadoj.weebly.com/uploads/1/3/1/4/131438786/kilomagome.pdf
    • https://kufesolujuxubi.weebly.com/uploads/1/3/4/3/134373324/juzune_dikejekiriliba.pdf
    • https://xigodawi.weebly.com/uploads/1/3/4/4/134464905/goganopurad_vipiveruwizaba_kedibexir_xezumapule.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cdn.shopify.com/s/files/1/0481/4972/5335/files/8648924301.pdf
    • https://cdn.shopify.com/s/files/1/0500/9519/4273/files/phone_keypad_apps_for_android.pdf
    • https://cdn.shopify.com/s/files/1/0429/1883/8435/files/the_guide_chapter_summary_13.pdf
    • https://cdn.shopify.com/s/files/1/0485/2468/9563/files/6740779515.pdf
    • https://s3.amazonaws.com/sezutuma/interval_notation_practice_worksheet_with_answers.pdf
    • https://s3.amazonaws.com/tadovu/delegation_of_financial_power_1978.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000796a.bin
22b397b2e0ef02ff1a5567d5b3bbc255d187033cff562e489c857b1dc551e57d
pdf-font-stream PDF embedded font (sfnt) at offset 0x796A 4956 bytes