Malicious PDF — malware analysis report

Static analysis result for SHA-256 c65a94d73f0e44f2…

MALICIOUS

PDF

44.6 KB Created: 2020-10-18 14:06:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 9ce48a636853483158afd30b8f943b5d SHA-1: ff30d257fbd510ce082cc0e794b0edfb7459160b SHA-256: c65a94d73f0e44f2bdcaa7db842e343b41e4b02af20d1784490bc9c210a0c219
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK, pointing to 'https://gettraff.ru/123?keyword=fifa+16+mod+2020+android'. It also exhibits PDF_SEO_LINK_FARM behavior, with numerous links to external PDFs, many hosted on Shopify. The document body, though heavily obfuscated, contains the redirector URL and references to 'Fifa 16 mod 2020 android', suggesting a lure to disguise malicious intent. No scripts were extracted, but the presence of embedded URLs and the redirector link strongly indicate a malicious download or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?keyword=fifa+16+mod+2020+android In PDF document text
    • https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/154782.pdfIn PDF document text
    • https://vonubaxuted.weebly.com/uploads/1/3/1/4/131452839/4129340.pdfIn PDF document text
    • https://jiwadurator.weebly.com/uploads/1/3/0/7/130776405/gomilimitara.pdfIn PDF document text
    • https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/nebiremopokexukite.pdfIn PDF document text
    • https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/3824865.pdfIn PDF document text
    • https://mapipuluzobeb.weebly.com/uploads/1/3/1/3/131398440/xexakivepixona-pajof-davewuza-sasetoj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/2044/3045/files/wuzimedekujuzejojamodes.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/6109/9675/files/comp_xm_exam_reddit.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/2895/8365/files/tesla_motor_club_model_y.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/8837/0582/files/susomoronetakoxoxapunigiv.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0478/1791/6575/files/figagotugebusefiva.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5811/0363/files/guwumaripulipubid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7b1854d-6f2d-47c1-802a-5ee135b5df60/43275764322.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/414f8af3-ba01-424c-b053-7f9906219d97/69310430847.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/6707/9830/files/deguvavefu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/4895/9142/files/disney_world_logo_history.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/2627/1384/files/67_ways_to_make_her_come_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006042.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6042 5276 bytes
SHA-256: 3c1a4ad013f7526497b38bfb4e6899e6af1b9ec878e90dac679d4598e18272d2
font_01_sfnt_off0000721a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x721A 3316 bytes
SHA-256: 580c36810e3907c3b5e3b4cd7aeb81de6a8d3ae2e3a8774a89a6c6ef6827ca08
font_02_sfnt_off00007fa2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FA2 11256 bytes
SHA-256: 95b00e700de77f541a28d5497ecb1eb4235f549f95ec815584d00d387f13e1c1

Open this report in the interactive analyzer, or submit your own file for analysis.