Malicious PDF — malware analysis report

Static analysis result for SHA-256 a769cfac359dfea9…

MALICIOUS

PDF

47.5 KB Created: 2020-10-05 14:04:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 059c4fe6b0196902c488c3fe27670eda SHA-1: 948fb0594564127142e9104332c4e4504309baae SHA-256: a769cfac359dfea9bc159d2615a60665d48bcd703fcffdfac9fc89227a1de8ff
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though partially corrupted, suggests a lure related to a 'letter to a classmate'. The presence of a link farm and a malicious redirector indicates an attempt to direct users to potentially harmful content or download further malware. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=carta+para+un+compa%25C3%25B1ero+de+clase In PDF document text
    • http://wubojala.dturnerla.com/uploads/1/3/1/4/131437079/fumofepazi_dobetakow_bawuvoj_xiseberasonu.pdfIn PDF document text
    • http://soniwexo.samanthanathey.com/uploads/1/3/0/8/130814328/nofuzizuzoxurarupidi.pdfIn PDF document text
    • http://tofazosin.taylorcdotson.com/uploads/1/3/2/7/132710712/xujatetu.pdfIn PDF document text
    • http://files.justbringbaby.com/uploads/1/3/1/4/131410007/siwinuliki.pdfIn PDF document text
    • http://files.marinersguide.info/uploads/1/3/0/7/130776166/376096.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a4566a3-8803-4f8e-ac35-613465ebb232/serololibo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1f03528-2f2c-47bd-b837-fd8a660de709/36688641547.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18627086-f179-466f-9f4c-db3434e058b3/43352306621.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d40a22eb-07cf-49ee-8308-c7fee1e8fcc1/pebopufovo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0dfb2bfd-033c-44bb-a750-2526bebb36e3/33914053757.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ac09df0-fbe8-4f35-b2f7-3087e0320a75/zomulizanuzet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e983e45-1ed9-4e0f-8b5f-a5e7726b43ad/zasimopovu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c63c80e-681a-4811-9f5a-9537afe8e7e0/lokokejena.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edc382c0-b91d-42e7-adf0-e55dca06a737/tojibokekipa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6338850-1a2d-4709-978c-15f2c560e892/lujotunodaxa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A21 5336 bytes
SHA-256: 3b867bed659901ec4b418870e65318e2829dd23ff401c2345e2dee7d99dbf1d1
font_01_sfnt_off00008beb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BEB 10796 bytes
SHA-256: 00a841b81e74c3342b56e05348a91d9c4eb7bacedaaf93d2fd03d091cd93ac53

Open this report in the interactive analyzer, or submit your own file for analysis.