Malicious PDF — malware analysis report

Static analysis result for SHA-256 a179ed164aa4534b…

MALICIOUS

PDF

43.6 KB Created: 2020-11-08 16:02:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: e23aa882de91176f4dcc3a8eddc87e66 SHA-1: bcbe6b60241e56644b145fb0946478d644f6ab37 SHA-256: a179ed164aa4534bda7960d05340c6af4d216ddbdab01859e8e88d82637fa7af
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with at least one pointing to known malicious redirector infrastructure. The ML classifier strongly flagged this PDF as malicious. The document body itself contains obfuscated text and URLs, suggesting an attempt to disguise the malicious intent of directing users to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/123?keyword=is+dc+universe+price In PDF document text
    • https://cdn-cms.f-static.net/uploads/4368265/normal_5f87b48052523.pdfIn PDF document text
    • https://wavupuzubeje.weebly.com/uploads/1/3/4/2/134235525/poraferefi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369905/normal_5f89dc662dd68.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370540/normal_5f93efdf0cf92.pdfIn PDF document text
    • https://fimelaxezabu.weebly.com/uploads/1/3/4/6/134622198/5847508.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365646/normal_5f86ffb994b20.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413474/normal_5f9fd3e05ad55.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381988/normal_5fa77a24eab6c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vobuturinivi/is_204_queens_school.pdfIn PDF document text
    • https://s3.amazonaws.com/zemigiduwagafu/advanced_public_finance_and_taxation.pdfIn PDF document text
    • https://s3.amazonaws.com/sixenogafopoj/88182938235.pdfIn PDF document text
    • https://s3.amazonaws.com/vuxalirudidel/tonax.pdfIn PDF document text
    • https://s3.amazonaws.com/sinamozagemoger/rosario_de_sanacion_maria_rosa_mistica.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C58 4824 bytes
SHA-256: 160eab33a4e56d539664d96224d1df8b92c1090567965f1c103a3121d5db7a6d
font_01_sfnt_off00007cd8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7CD8 10928 bytes
SHA-256: fc68bfc422668f2474317524bcb373dd0136fb0381ae8ec191cff66a82623b45

Open this report in the interactive analyzer, or submit your own file for analysis.