Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d46aa75e6b2d4fa…

MALICIOUS

PDF

123.9 KB Created: 2020-10-27 09:29:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 258a433f02598832f4b20e1910a5bc1f SHA-1: 50cd07d84be7beb4f8a047055e9d8212f71c4a88 SHA-256: 9d46aa75e6b2d4fa94ee9fe59ba98abe059fb705b7a9bdb784c41389713c8c68
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link disguised as a search result for 'Ezra pound cantos full text pdf', which redirects to a malicious URL. This suggests a phishing or scam attempt, likely delivered as an attachment. The PDF also contains a large number of links to other PDFs, indicating potential SEO manipulation or a link farm used for distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=ezra+pound+cantos+full+text+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365584/normal_5f8a7eb741030.pdfIn PDF document text
    • https://jijidiwudop.weebly.com/uploads/1/3/4/4/134481930/bozowitakilesozer.pdfIn PDF document text
    • https://lesuwigiwojan.weebly.com/uploads/1/3/4/3/134309114/8211b511.pdfIn PDF document text
    • https://suganolorifumu.weebly.com/uploads/1/3/0/8/130814011/zegugab.pdfIn PDF document text
    • https://moguvikob.weebly.com/uploads/1/3/0/8/130874292/museluti.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0493/6522/1535/files/supreme_court_of_ohio_writing_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/1195/6126/files/cheap_phone_sex.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/3071/5288/files/fejolixawepipabux.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/6775/2100/files/70881151613.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0485/1115/6386/files/shazam_old_version_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/rovobitoworuxanuzuzared.pdfIn PDF document text
    • https://s3.amazonaws.com/duzexefemosaxe/kaplan_asvab_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/mejados/tinul.pdfIn PDF document text
    • https://s3.amazonaws.com/saziwijaxodav/43194877338.pdfIn PDF document text
    • https://s3.amazonaws.com/pezofut/bg_etem_gefhrdungsbeurteilung.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/3507/3943/files/mlb_attendance_2015_by_team.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0503/7942/3942/files/the_human_digestive_system_worksheet_biology_if8765.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5339/1782/files/we_are_monsters_cartoon.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/6123/2294/files/xaxijepemuruzizefataxaduf.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0494/4068/6239/files/gerund_infinitive_exercises_with_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/9729/1941/files/early_years_foundation_stage_framework.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/4012/6614/files/mackie_sr24-4_vlz_pro_service_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/5921/4496/files/com.radio_javan.android_radio_app.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/2885/4964/files/fimobuvagubevelebuwomo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/6645/8266/files/ron_atkinson_smu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a6fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A6FC 5224 bytes
SHA-256: 45598f33b76d5619c58b93ad2eff85b6d96534b166fdb803f121b73dfd12f8d2
font_01_sfnt_off0001b8da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B8DA 12888 bytes
SHA-256: f4c68280b50cfd6fb20dc759f6ae693339381c9bea811b340a72d6f7a33af50e

Open this report in the interactive analyzer, or submit your own file for analysis.