Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4c43d97dd337a22…

MALICIOUS

PDF

43.1 KB Created: 2020-10-28 20:20:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: b2a1265f8f3d0615582edf6f1d0dcc66 SHA-1: 294446669e2fa8c5e8fda5622de2450fda9ddcdd SHA-256: a4c43d97dd337a22c5d9b7cb28de3711bdabb55e75023e1e42df699e2ff5626e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, many of which point to external PDF files, forming a link farm. One of the primary links directs to 'ggtraff.ru', identified as a malicious redirector. The document body text, though garbled, contains the same URL, suggesting an attempt to lure users to malicious content under the guise of 'unblocked games'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=new+unblocked+games+77 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4370055/normal_5f8fbbf11d5ef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379486/normal_5f8f77945a3ec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375095/normal_5f8a91b82306a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404739/normal_5f95be6319ec9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372360/normal_5f8d2a632d7e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380871/normal_5f8b3d30eada8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378855/normal_5f8b38fa6509a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382780/normal_5f923579105c6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/68e2da5a-a494-443c-81d3-63178cd2ffb3/gumajogivovodez.pdfIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/kabbalistic_magic.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9124/0122/files/tojunulul.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/2815/9381/files/12882921881.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0495/9931/6131/files/12_powerful_words_song.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/9085/7121/files/84478886007.pdfIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/preventive_and_breakdown_maintenance_comparisons.pdfIn PDF document text
    • https://s3.amazonaws.com/jumedemimo/endless_praise_lyrics_and_chords_by_planetshakers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d445d3b3-d751-4ead-be80-af46fda67b64/41597416504.pdfIn PDF document text
    • https://s3.amazonaws.com/pafiganovavi/bnf_70_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/5101/6614/files/vanusezadakipuroxadi.pdfIn PDF document text
    • https://s3.amazonaws.com/leguvefu/agriculture_board_exam_reviewer.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000676c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x676C 5508 bytes
SHA-256: 539c567062d7815e63f195db97af6900d453a69ae8867a9abd2dccd684b745a7
font_01_sfnt_off00007a3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A3D 11256 bytes
SHA-256: 4d9e63f393ccbe3bcd69d5384963b3c31d6d09aab9452c8e975fb6e9402f7c12

Open this report in the interactive analyzer, or submit your own file for analysis.