Malicious PDF — malware analysis report

Static analysis result for SHA-256 93af398699c616f0…

MALICIOUS

PDF

68.2 KB Created: 2020-12-20 05:28:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18e6ffb9b9e643d64392e0d46cf2e259 SHA-1: 742c6e9e453241bdf43cefc3500c8298a4e0946d SHA-256: 93af398699c616f0b1fcd13ace8453170d962bb366ce6771d02d5e4ee8621d84
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged by a machine learning classifier and heuristics indicate it functions as a malicious redirector and link farm. It contains numerous embedded URLs, with at least one pointing to known malicious infrastructure and another to a link farm designed to host further malicious content. The document body is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=imperfect+authentic+cadence+in+c+major
    • https://jesasifewom.weebly.com/uploads/1/3/1/4/131453969/gomedelep_joviwoge.pdf
    • https://cdn-cms.f-static.net/uploads/4426822/normal_5fa1092ae6411.pdf
    • https://bopugokux.weebly.com/uploads/1/3/4/9/134901566/rofabutim_xudekilure.pdf
    • https://cdn-cms.f-static.net/uploads/4368243/normal_5f8a9cfdc258b.pdf
    • https://fovubimosifiwu.weebly.com/uploads/1/3/4/3/134324820/zitujokoso_poduzomuduv_lezakat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://static1.squarespace.com/static/5fc4fb53df132613bbd7c09d/t/5fc646643c6ccf69f3348036/1606829670177/rapunzel_live_action_movie_cast.pdf
    • https://static1.squarespace.com/static/5fcee768e3661f04ea87a4e5/t/5fd62010d654060362bf6de5/1607868433606/bollywood_movies_2018_in_hd_mp4.pdf
    • https://static1.squarespace.com/static/5fde7b11617c13787ca3ef9c/t/5fdeadc5e64f5703152fc9aa/1608428998158/abc_writing_worksheets_free.pdf
    • https://static1.squarespace.com/static/5fc5d014ec917750a3f94da0/t/5fc6fe97b7521d608a3a6d3b/1606876823690/chocolate_cake_cooking_temperature.pdf
    • https://static1.squarespace.com/static/5fdea684ff074777c984c22e/t/5fdeaafca478394ebca8283f/1608428285686/whatsapp_application_for_computer.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf57e4a97599144eee7e45/1606375398509/st_clair_county_humane_society_il.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5eef1972c46e3c96514a/1606377200265/97414485098.pdf
    • https://static1.squarespace.com/static/5fc518149698b02c7f3bb327/t/5fce2f9f5d2e6f3bda671a7d/1607348131274/birthday_cake_decorations_for_mom.pdf
    • https://static1.squarespace.com/static/5fdd38515b7bc966055e0f1f/t/5fdd7682c18bd5077c8b33ac/1608349317010/children_s_learning_reading_books_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c29e.bin
f51e6c0727f59a53e434aadf4e51fb9a7b018097888059c3ea64d1272d4da92c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC29E 5080 bytes
font_01_sfnt_off0000d3b0.bin
503298f7fb7b06ed377ab375b7887c249bc3a255ff08fbec17e60d4ed2856d47		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3B0 9984 bytes
font_02_sfnt_off0000f5e2.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5E2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.