Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbbc0a7c5d0d7ccc…

MALICIOUS

PDF

45.4 KB Created: 2020-11-02 15:39:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: b7ca51a0a45565311728bdf02d58ff56 SHA-1: 500d3ee67fb4269a7f532cb89cea301463492f6c SHA-256: bbbc0a7c5d0d7ccc7347e84eeddc22252c2bb7b868db60aa1d9d9b7b71a4034c
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that lead to known malicious redirector infrastructure, specifically identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The document body, though heavily obfuscated, contains a URL that appears to be a lure for users seeking a "cube root worksheet". The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=cube+root+worksheet In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365646/normal_5f894aa470aab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367914/normal_5f933d37c8dc1.pdfIn PDF document text
    • https://gonoloxezejuje.weebly.com/uploads/1/3/1/4/131410007/kapujoxegude_zulipum_kalur_voruzod.pdfIn PDF document text
    • https://wogijelagorezu.weebly.com/uploads/1/3/4/0/134096035/tazuni.pdfIn PDF document text
    • https://luxapojago.weebly.com/uploads/1/3/4/3/134327771/paporatufepo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/197a0e96-ea69-4f49-ae7c-c6b2047e149b/47017622548.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/639747ad-b8d1-4c22-9bdb-8604eec0f7b2/90937754895.pdfIn PDF document text
    • https://s3.amazonaws.com/fibesezati/computer_acronyms_and_abbreviations_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/126a5f80-dee3-4930-991e-3dade8f78872/24019143850.pdfIn PDF document text
    • https://s3.amazonaws.com/ratixifo/35199801974.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9776b9e0-00bf-49d7-bdbd-ef74cc5bd9ce/traktor_pro_2_download_full_version.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af4d0209-bce7-4725-8c42-835c4eb570cc/tivoreninilezakobisotir.pdfIn PDF document text
    • https://s3.amazonaws.com/xakapudakadu/60089674837.pdfIn PDF document text
    • https://s3.amazonaws.com/tojabixefova/gold_rush_season_9_boat_accident.pdfIn PDF document text
    • https://s3.amazonaws.com/wonoti/lofeteromakuvonoze.pdfIn PDF document text
    • https://s3.amazonaws.com/megulu/differential_equations_second_edition_polking_boggess_arnold.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E6F 4732 bytes
SHA-256: 5010a93535cda06eaa48062cb07f2ebc78b51be15fc78b634d59bd70a188a779
font_01_sfnt_off00006e92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E92 10632 bytes
SHA-256: f528815c1b2ccd4fc43a1c0764a86d2b89c8d4c9c13221f84720d762bea1a46a
font_02_sfnt_off000092fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92FD 16236 bytes
SHA-256: cc9618900e256a39069df4d65f1d540b234ab68123a8689fe770a3579ee18932

Open this report in the interactive analyzer, or submit your own file for analysis.