Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fba272f77b49276…

MALICIOUS

PDF

41.8 KB Created: 2020-10-05 21:20:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 7bfabafd812f0a059b1b6d42248e99db SHA-1: e4f5068b617266949325ea706fc2151eb3750653 SHA-256: 9fba272f77b49276f78406d7f9e5773b426d9a771f776be6b0749e614ccb05a4
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to external resources, indicating a link farm. One of the primary links, 'https://cctraff.ru/strik?keyword=pokemon+reborn+7th+street+luna', is flagged as a malicious redirector. This suggests the document's purpose is to drive traffic to malicious infrastructure, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=pokemon+reborn+7th+street+luna In PDF document text
    • http://files.thelovelypets.com/uploads/1/3/1/1/131163559/8729340.pdfIn PDF document text
    • http://jezopimix.marsworthschool.co.uk/uploads/1/3/1/8/131856278/fadutabemupare.pdfIn PDF document text
    • http://files.shopwildgoat.com/uploads/1/3/1/6/131606629/mitatage-fokuwepep.pdfIn PDF document text
    • http://lanutumol.silvestretraining.com/uploads/1/3/0/9/130970023/7912774.pdfIn PDF document text
    • http://zepix.joyingrief.com/uploads/1/3/1/4/131407316/basawerepifoka-puragul-gojikina-kedarigoxevewod.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/db52ed73-b02c-41cb-b043-de52057379de/37094546979.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22373013-a0a6-4902-8059-952741f9e877/97888147096.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db4aebdc-154b-4a77-a09a-a56e18078ee2/99486168633.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c191b260-062a-4559-be59-4f7d9624b5c4/redoturarexudir.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/3076/4955/files/30658698354.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/4232/7707/files/sql_begin_transaction_commit_rollback_example.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0480/7308/0996/files/lords_mobile_monster_hunt_research.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/3241/0272/files/self_confidence_in_sports_psychology.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0459/1249/0133/files/calendario_escolar_2018_hisd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11804d20-8e79-48ed-88d0-af5c15a32942/20780192080.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcf6e69d-9010-4ab2-b61c-10aea1c718ba/32860223169.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8be678f-fe54-4155-b9c2-268ce6ff94bd/ledejegofosuxuxovogapi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcc22dd9-d621-4309-b18a-bdff9bc2a7a6/tipatodegaw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07e8db42-a212-4439-ac75-6c2cbf7bfc49/86348785346.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64CF 5208 bytes
SHA-256: 4ba0e75436bf036ea02d9f04425520de782b87f058162b1065a0bfaba086a7a9
font_01_sfnt_off00007662.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7662 10388 bytes
SHA-256: 16bd1a191aab2d62a49529d5042a2fb5a78e2c5f26db3aaa6d0b604ae23cdedd

Open this report in the interactive analyzer, or submit your own file for analysis.