Malicious PDF — malware analysis report

Static analysis result for SHA-256 99c6e8f969e82ab3…

MALICIOUS

PDF

74.1 KB Created: 2020-11-05 05:43:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 6964aa1f9bac29cee77c56bd3eaddcb6 SHA-1: b98a2333a04f3ca06e5071a74c900f518e65fef6 SHA-256: 99c6e8f969e82ab3460f7ab015dae003595975d11b6cbb529032ca7d71092fe4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links, including one identified as a malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector found by heuristics. This suggests the primary purpose is to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=henry+miller+books+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365655/normal_5f8d9af211d7d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406213/normal_5f91c6207a49a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375541/normal_5f8d86255f4c1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385427/normal_5f9c865b5b8a5.pdfIn PDF document text
    • https://riwuwodanujebu.weebly.com/uploads/1/3/4/2/134234990/zamofujexomixog.pdfIn PDF document text
    • https://rimenedefogifu.weebly.com/uploads/1/3/4/4/134466040/mokesupak-bumeval.pdfIn PDF document text
    • https://fidevawane.weebly.com/uploads/1/3/0/8/130814252/728af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388293/normal_5f961d58db794.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374369/normal_5f8d303aa00c0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wixanarer/satogapokibum.pdfIn PDF document text
    • https://s3.amazonaws.com/kawotexulozax/52346044819.pdfIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/53178783199.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d33a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD33A 3488 bytes
SHA-256: 0329ea9b72742d8159d68ead3d557b8e43695ae1a5ee7502a770183811b26e6d
font_01_sfnt_off0000dfa4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFA4 5244 bytes
SHA-256: a7c216b7b4222f778523a1cfaec79121d975455f903c9dd7249966ed43ef76ea
font_02_sfnt_off0000f168.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF168 13088 bytes
SHA-256: 95fcda1d2abb82b8350d835e276c5efaad045705217c826251db5d8d26c6049f

Open this report in the interactive analyzer, or submit your own file for analysis.