Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0042087e6b7c293…

MALICIOUS

PDF

45.0 KB Created: 2020-10-16 19:44:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 24fca601f93956ce50afaaf38eec7d30 SHA-1: f65406c2eb9945073c2786d004f1f0ba06b30f6c SHA-256: a0042087e6b7c293c456c730e37e2713785f622181dd6f343b6a621c74425114
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, with one identified as a known malicious redirector. The document body, though heavily obfuscated, contains URLs that are part of a link farm, suggesting an attempt to lure users to malicious sites. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=semejanza+entre+mito+y+leyenda In PDF document text
    • https://netaluzubik.weebly.com/uploads/1/3/0/8/130813777/5f2f19.pdfIn PDF document text
    • https://vupimolafi.weebly.com/uploads/1/3/1/3/131398504/cccc80ae49d9d77.pdfIn PDF document text
    • https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/nukexifepejisox.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365580/normal_5f891a70bd1e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365636/normal_5f871a76ed6e1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366011/normal_5f870fcbf0863.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d16f66b3-4b23-4004-ad97-05f36064386c/75754330936.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e1d62f9-400a-406a-8aae-32c252182a91/lipurelutifakeb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d150d47-d5e0-4dbf-adc7-09654a257b18/fesajiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17ca98af-10ea-4e98-921f-bebc41c6f06b/janafurolutobipilolap.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c151cb8b-b30a-49f4-89c7-52206fea2070/24382297744.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5964e5ef-e534-49ba-9136-a3c38be394fc/tedomogunun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/34893378-b3cb-44cc-89e0-2bd99a53ee9b/42125877778.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/daeab75f-42a1-4a7a-a9ec-cbe1729423eb/88397277113.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7119c6ed-614f-4627-a8f7-ebd1fc8538ee/63466686704.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ece05803-7685-4da9-9310-41c3b439656b/kivapujeguvelunaxexe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b6cae77-eb68-456b-b598-4ea6b78080cc/20017770756.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ed0aabf-01c2-420e-b253-c7fe3fd6303d/gokizogu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ed0eae0-1a86-4499-a284-6751d43fe5b7/85260128341.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/811f10d1-73ee-489f-b4ee-8cc6ee3a080a/26781357085.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37e57011-c7d3-4941-805e-36636eaf0159/37363035694.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f462e2e4-754d-4738-8963-fbf23dc06c96/jilamosija.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000070ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70AC 5124 bytes
SHA-256: 801ef81b0302a2f656ab080af02b9eeb8ae9419b7e8d0816eeb604b011dffaf8
font_01_sfnt_off0000820e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x820E 10748 bytes
SHA-256: b3b599a0655ffaa7c1fbc9569080685ca4be49b7b47ee804da1d9674af4d3f04

Open this report in the interactive analyzer, or submit your own file for analysis.