Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca73bda433b2641b…

MALICIOUS

PDF

40.4 KB Created: 2020-10-04 08:19:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: baa67ae7993031191dce419aaee5b7d5 SHA-1: 6069a29e5cac13aa6413f10f9e3b65dd9db2098f SHA-256: ca73bda433b2641bf00ea1e1da4f5664100b1d32f85fa369930b57d26678a126
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links that redirect to malicious infrastructure, specifically identified as a redirector. The document body, though heavily obfuscated, contains text related to 'solving two step equations worksheet' and includes the malicious URL, suggesting a lure to disguise the malicious intent. The presence of numerous external PDF links further indicates a link farm or redirection scheme designed to obscure the ultimate destination.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=solving+two+step+equations+worksheet In PDF document text
    • http://files.starlight-angels-ministries.org/uploads/1/3/1/6/131606035/9703040.pdfIn PDF document text
    • http://jubukexu.gracebecker.org/uploads/1/3/2/6/132683138/3248077.pdfIn PDF document text
    • http://luwem.theemergencefoundation.com/uploads/1/3/0/7/130739906/wixuwadababorerewud.pdfIn PDF document text
    • http://vepaxuf.rjupmarketpress.com/uploads/1/3/1/6/131637881/69ac8c416b6951f.pdfIn PDF document text
    • http://muvilapav.godworkscf.org/uploads/1/3/0/9/130969373/7844549.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a7a902d-41cd-44cb-920d-95f6534d8668/tanodig.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3205836e-83ec-485a-9558-68d7cc89311d/26730291429.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58538a9a-737b-48b8-8bff-6515220bfdaf/87378976339.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cd28e47-b90d-4cc4-acf5-d8fe6b1cc1ce/dojot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/013f9922-5ccb-4ef6-94e4-a4074cf8965a/linop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84b2ef40-89bb-4a41-bfc4-7f10dbe5586d/kopujofezize.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/136e597b-119e-42f0-b761-df5a888d8afc/91876163837.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005fb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5FB3 5524 bytes
SHA-256: ac7e4a704fd6d77d60164e8b5882e4afaf1022a8ab5d84848af05d8eef92a88a
font_01_sfnt_off0000728c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x728C 9968 bytes
SHA-256: 18bc4b04a2e50f6df0d838d91e0e1747c3cafd52d4d2e99f9d9560015bf63445

Open this report in the interactive analyzer, or submit your own file for analysis.