Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5a114b73491f92c…

MALICIOUS

PDF

42.2 KB Created: 2020-10-04 10:29:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 5e9f4aac3401b5721c575c0b54ed4e2f SHA-1: e9592045eeafc3203bd67e39c296bf3022fb0ad1 SHA-256: c5a114b73491f92c85cf98bcc469aea5132fbddfe2b5f5ab58f9b5f085f5a496
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a lure related to 'word whizzle dinosaur answers' and embeds a URL pointing to a malicious redirector. This redirector is part of a link farm, suggesting a tactic to distribute malicious content or engage in SEO manipulation for malicious purposes. The presence of numerous links to other PDFs, some of which are benign, indicates a broader campaign potentially aimed at obscuring malicious activity or maximizing reach.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/pify?keyword=word+whizzle+dinosaur+answers In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/51427798-9aea-4ddd-91a6-e7f4b5b8705e/30639229990.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59d4229b-3d52-4961-bd01-596883817299/tixizuzopepisuvuw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2cfd438-b21b-4501-bf77-8e3857cfc77f/85653343800.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/3293/9166/files/homologous_structure_definition_biology.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0468/0404/1879/files/under_counter_radio_cd_player_bluetooth.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/7983/5547/files/detevowujosiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff5c0360-67c4-4d0d-b6a4-f9ba062b2101/68659395999.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f5f7f6a-4984-4fd6-a43f-cd9c9c2cc306/30621838542.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a89fe602-324e-4090-96c5-d73d0b65d41a/69660181326.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/3854/6840/files/tifilazeluzumepilenivo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0479/1608/9510/files/17993238536.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/1055/5041/files/asics_gel_nimbus_16_mens_sale.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/6105/9482/files/skam_italia_season_3_episode_2.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/8206/3778/files/50260144137.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000683c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x683C 5068 bytes
SHA-256: cb0ce7a91c024d0e9295cce79301cb4a24e88e6466cce165f396742847d9f6e6
font_01_sfnt_off00007991.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7991 10120 bytes
SHA-256: f3ca8f6cb972d668787892dc5b9d15b970fb6bc2839b95d73e96a1b6d05818d6

Open this report in the interactive analyzer, or submit your own file for analysis.