Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6cbd78b09d29337…

MALICIOUS

PDF

48.0 KB Created: 2020-10-25 20:27:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7471bf3f6c9de25bb2979a1552d61751 SHA-1: 1d84d5ab98c3f12de7fbeffef417b32c71e09b0d SHA-256: b6cbd78b09d293378e7047c18a767645842887a700d705314759f08afe02dc2e
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, including one pointing to a known malicious redirector. The document body, though heavily obfuscated, contains the URL 'https://gettraff.ru/aws?keyword=nepali+language+book+pdf', suggesting a lure to download content. The presence of multiple external PDF links indicates a link farm strategy, likely to improve search engine ranking for malicious content. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=nepali+language+book+pdf
    • https://mogijoduvide.weebly.com/uploads/1/3/0/8/130814471/ligireziwunezafenud.pdf
    • https://mixekolasum.weebly.com/uploads/1/3/4/3/134388380/83c548bd.pdf
    • https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/wikerigarotivux.pdf
    • https://sonujesenusa.weebly.com/uploads/1/3/4/3/134344018/2801123.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/6f0c2a9d-4b40-48fa-a4df-867d28a1b99d/32581947498.pdf
    • https://uploads.strikinglycdn.com/files/19bb6552-d429-4688-87f3-aae50c40863c/bofima.pdf
    • https://uploads.strikinglycdn.com/files/40596590-7006-4152-8551-8e993b391a6e/73934656255.pdf
    • https://uploads.strikinglycdn.com/files/e330294c-d1d7-44a4-8178-f69c2233e3cc/30480478897.pdf
    • https://uploads.strikinglycdn.com/files/481b7cb2-1a02-48f3-bde5-73b2e045ff09/43539985258.pdf
    • https://uploads.strikinglycdn.com/files/e8fd0972-fc1b-4f58-bbf4-692a5cc0520d/the_force_awakens_novelization.pdf
    • https://s3.amazonaws.com/xanebavifamopez/61642116533.pdf
    • https://s3.amazonaws.com/susopuzupure/bavapub.pdf
    • https://s3.amazonaws.com/baxunaf/ncert_biology_book_class_11_free_download_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/20d4d15b-4c82-47fc-9773-c80a08705237/civics_eoc_review_packet_7th_grade_answers.pdf
    • https://uploads.strikinglycdn.com/files/7a941c59-cd8a-4fdd-ac3c-57f0cb2f252a/wivagufifekim.pdf
    • https://uploads.strikinglycdn.com/files/4348a31c-36f3-4552-ad9b-1cc5842af2ec/co3_2_resonance_structures.pdf
    • https://uploads.strikinglycdn.com/files/d4eb3c01-9259-4aa1-b30c-b57be7d17a20/56622810893.pdf
    • https://uploads.strikinglycdn.com/files/ef895831-7fc2-4309-930d-a5cdb6b97438/lettre_a_un_notaire.pdf
    • https://uploads.strikinglycdn.com/files/0281fffb-5e18-424c-a305-7b82371830a6/mupirocina_isdin_20_mg_g_pomada.pdf
    • https://uploads.strikinglycdn.com/files/c572c0f2-9164-479f-8433-a3668548c3e2/dafubekova.pdf
    • https://uploads.strikinglycdn.com/files/e0d7e5c0-a174-4381-a4f2-ffb74317f809/libazoboxarorujalipu.pdf
    • https://uploads.strikinglycdn.com/files/aa1e500c-e777-40e3-82d0-b1ed14eb0c16/petegimikekitom.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000057b4.bin
dafb0a5000141c03e95e6efef0bc3ec6d0628241309abecc311a1b1575cf91a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x57B4 4912 bytes
font_01_sfnt_off0000686f.bin
73e8e14bccbb6ba999d6226425ffbbab56a4d6b2fe1ca2e5a3215096336f9aae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x686F 11340 bytes
font_02_sfnt_off00008eff.bin
2732c78df68b4531e26da51a256f0f9ab881cb8a96d1886ade34872d88eeece3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EFF 16140 bytes
font_03_sfnt_off0000a3fc.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA3FC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.