Malicious PDF — malware analysis report

Static analysis result for SHA-256 c31631fa7cd4fc00…

MALICIOUS

PDF

53.2 KB Created: 2020-10-26 09:11:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 83160b638c483a438245bdc566959337 SHA-1: 1bc25c655d52d5d51d47ce0c89ce4799c2ddd555 SHA-256: c31631fa7cd4fc0076820dac7e174fa877c791f01624c6fce3bd5e3a871c3ed3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with one identified as a malicious redirector. The document body, though heavily obfuscated, also contains URLs that appear to be part of a link farm, likely intended to lure users to malicious sites. The ML classifier strongly indicates maliciousness, and the presence of redirector links points towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?keyword=obstetrics+and+gynaecology+by+ten+teachers+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4382209/normal_5f966d0e7105a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369764/normal_5f88ce4a78eb4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387590/normal_5f8e9d1c79995.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382780/normal_5f8db5accfd41.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373297/normal_5f8f70057c9a4.pdfIn PDF document text
    • https://vavavutexe.weebly.com/uploads/1/3/4/4/134441002/5241478.pdfIn PDF document text
    • https://tidemipevu.weebly.com/uploads/1/3/0/7/130740592/7408075.pdfIn PDF document text
    • https://fapifejoj.weebly.com/uploads/1/3/4/2/134265577/todewapizezu.pdfIn PDF document text
    • https://zisokilusativ.weebly.com/uploads/1/3/2/3/132303079/vixobujujotugo-lolivativisak-gifuxu.pdfIn PDF document text
    • https://nowigusoludi.weebly.com/uploads/1/3/4/2/134266380/7289025.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://cdn.shopify.com/s/files/1/0427/6341/9815/files/android_sdk_tools_25.2.5_download_free.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/0590/1991/files/52527424137.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0436/1574/8253/files/verojujabuwukalu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/2968/8231/files/1058549273.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/0674/6011/files/67897687945.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0463/1134/2242/files/wireman_licence_a_past_papers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/0794/0520/files/wuvemupiwuzexapofik.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/5693/8146/files/5457325056.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/4154/5111/files/54713682671.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbfb2d97-aead-44f7-aed6-437dbfa04037/rajenunoxekadimesulamuje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2e16041-0412-45ff-8353-e39bc6c20583/91042776732.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3605cfa-7043-4057-9f47-06a59a72927a/yn_560_iii_set_group.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30e45d6c-10bf-4d5a-928f-f1e16376d7e8/27748969774.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/079fb706-98ce-437e-9c22-66b33cebd3f3/zewegedife.pdfIn PDF document text
    • https://s3.amazonaws.com/mijedusovineti/vuxudavavunurokuw.pdfIn PDF document text
    • https://s3.amazonaws.com/fasanag/jotuzagibowanaruw.pdfIn PDF document text
    • https://s3.amazonaws.com/tejuvonixag/rigurinizodofogogu.pdfIn PDF document text
    • https://s3.amazonaws.com/kulinisokakewi/great_answers_to_tough_interview_questions_martin_john_yate.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00008d65.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8D65 23856 bytes
SHA-256: da2826d3105268f307006cbc6774f9d00e32857a6f289521e80a92f313d51ca7
font_00_sfnt_off000058e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58E8 5476 bytes
SHA-256: 444d45ea79d66faf6fa441bb169adb0c2a34d57da80489adb5becd054049b939
font_01_sfnt_off00006b75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B75 9876 bytes
SHA-256: d5a9fa7983f1ac3a914791a1693d330acef976f5a0948f4fcd9db104074f2153
font_03_sfnt_off0000b809.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB809 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.