Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca04d7ec8bab4dbe…

MALICIOUS

PDF

47.8 KB Created: 2020-10-31 13:48:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d1c15b9f63a62562baf4c2d9bdcdf46a SHA-1: db61cd2c9edc333f83f19dd3ed829474919a1a5f SHA-256: ca04d7ec8bab4dbecab31311019958cd42828520931e8e72b1c0ee4a8ce9d267
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous links to external websites, many of which appear to be part of a link farm designed to manipulate search engine results. The document body itself contains a search query related to ethics, likely a lure to encourage clicks on the embedded malicious redirector link. The ML classifier strongly indicated maliciousness, and the presence of a redirector link further supports a malicious intent to lead users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=de+donde+viene+la+palabra+etica
    • https://cdn-cms.f-static.net/uploads/4411511/normal_5f974912462db.pdf
    • https://lajanasana.weebly.com/uploads/1/3/4/3/134368101/d65716e738bcc73.pdf
    • https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/zidebesirolabavo.pdf
    • https://zalawevovupat.weebly.com/uploads/1/3/0/9/130969727/7153082.pdf
    • https://mezuminekafowiw.weebly.com/uploads/1/3/4/3/134346911/kipewefebepim-jesifux-mixituwevafod-vexor.pdf
    • https://mewuvirinikupu.weebly.com/uploads/1/3/4/5/134505229/mewiferexukot.pdf
    • https://cdn-cms.f-static.net/uploads/4415334/normal_5f9ac64b8de16.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vunizi/ntn_bearing_catalogue_download.pdf
    • https://cdn.shopify.com/s/files/1/0503/0946/4249/files/26585170197.pdf
    • https://cdn.shopify.com/s/files/1/0502/7813/8018/files/67724939536.pdf
    • https://uploads.strikinglycdn.com/files/8dc3d977-cebe-454d-9c41-88592f0db1cb/javazemilitilol.pdf
    • https://uploads.strikinglycdn.com/files/610075de-e611-4163-81a1-4b72fffcd7f0/zolulebibarevuvadexinege.pdf
    • https://cdn.shopify.com/s/files/1/0483/5291/9703/files/guvixibaxibosalepaxesedib.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006312.bin
f7b66ce893971d49c4d0da067ecf5d2dd6d5029a4f200d3bca841aad917cc421		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6312 5088 bytes
font_01_sfnt_off00007472.bin
2f672138d68439abdf813b6e4464f6656ea8665bafa590cc191a867463b54f32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7472 11920 bytes
font_02_sfnt_off00009af3.bin
7507748dd3b0b61c8445662e79b0894f17c83e73bae53e4cd727c6858953722b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9AF3 16200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.