Malicious PDF — malware analysis report

Static analysis result for SHA-256 b535570445263acf…

MALICIOUS

PDF

39.5 KB Created: 2020-11-09 16:16:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: de92d5746187620aaaa06c38d91d798f SHA-1: e16762df75de40f6cd5ea34f511e7c64f95d821d SHA-256: b535570445263acfacde6d22d3ece90c9c77cc55d54cc26feb0d7c58149e5a06
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. One prominent URL, https://traffine.ru/aws?keyword=the+apprentice+easter+egg+nudality+uncensored, is directly embedded and likely serves as a lure. While no scripts were explicitly extracted, the presence of numerous external links and the ML classifier's high confidence indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?keyword=the+apprentice+easter+egg+nudality+uncensored PDF link annotation
    • https://memarexegota.weebly.com/uploads/1/3/4/3/134366516/tigosarowawoze.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369779/normal_5f8d97dc4e131.pdfIn PDF document text
    • https://sojejizewo.weebly.com/uploads/1/3/4/4/134460985/fojawawakerarus.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/86d6b27c-1f1e-491f-be0a-374454e01eb5/56515418354.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e864fb8c-0479-476b-a79a-b4faabfb15d4/bokonalexonaw.pdfIn PDF document text
    • https://s3.amazonaws.com/dotivaf/solicitud_desempleo_online.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/93872891069.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/padixoxabiwoxigijowo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6aa0d52-11e6-4a37-b4bd-474f20aeb867/folegolaselebigobanam.pdfIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/puzzle_fighter_mobile_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f681050-2021-4067-9a5a-490946f792b0/45757281840.pdfIn PDF document text
    • https://s3.amazonaws.com/paxivogedewilu/clipper_ship_foundation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67e400fb-ae43-4ead-81c8-ea5722b0d726/betatron_electronics_albuquerque.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/beowulf_poem_modern_english.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005077.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5077 3164 bytes
SHA-256: 8035a0078fd5fb0ab39ffaf7fc581daef6e14f487b6a00a3e22c6a1835a09921
font_01_sfnt_off00005bb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5BB0 5388 bytes
SHA-256: a128df2615715cab3bd8c2280e7a1bf85dd46adb073332072ffa46f4e19c9c3d
font_02_sfnt_off00006dfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DFD 10048 bytes
SHA-256: 2b289cd382b8c98b1bcd0ffdf0fbc6fd61dff09f550237e97e80071642e2631e

Open this report in the interactive analyzer, or submit your own file for analysis.