Malicious PDF — malware analysis report

Static analysis result for SHA-256 989358ad0dd508bf…

MALICIOUS

PDF

46.6 KB Created: 2020-11-02 05:19:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: c4ca7732709120771eb15e0a1aa29491 SHA-1: db6ac89cabc820d98b954be659ea307a95fab050 SHA-256: 989358ad0dd508bf21205e4b0b742b3b4565e28d898a078bdf400b98d3c32762
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/123?keyword=fire+emblem+binding+blade+gaiden+chapters In PDF document text
    • https://cdn-cms.f-static.net/uploads/4382948/normal_5f972053275dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365525/normal_5f8e3bf7ea574.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376612/normal_5f8c21e78c65e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371553/normal_5f944cd84288e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/4295/4651/files/gpisd_calendar_2015_16.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1083090d-39c3-4f75-be53-a0a4fba3691e/96792901032.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/4941/8389/files/download_hack_tap_titans_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b88cb008-ed35-47bb-b5b6-f91be9f9d9c8/75333377864.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0503/3544/9238/files/50402659721.pdfIn PDF document text
    • https://s3.amazonaws.com/xukidosifixi/zaffron_mediterranean_grill_hummus_bar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed1c069d-5491-46b8-a49f-7fde84c74584/mupuvirugilar.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/how_to_be_a_better_meal_planner.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e38b656-a449-46ef-9047-4bfaedff51ed/pavule.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000699f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x699F 3276 bytes
SHA-256: 98e8ddf2dc8b873ac9ec0b2b8e31910e4b6f453c74c38321bf688e5b07e50989
font_01_sfnt_off00007569.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7569 5580 bytes
SHA-256: 388e543e0425fd322f32356bb155be919f7e6de414d72ddaae28b12c90d7f6e3
font_02_sfnt_off0000882d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x882D 10584 bytes
SHA-256: 6bdac854c81f149c82aa01daf09b1e64b83ca29659df4a58ae341023cde3958e

Open this report in the interactive analyzer, or submit your own file for analysis.