Malicious PDF — malware analysis report

Static analysis result for SHA-256 cefed001ffce2375…

MALICIOUS

PDF

57.6 KB Created: 2020-10-28 03:42:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-12-28
MD5: c52d5b3633105a5003fe48bf407251b1 SHA-1: 85b4a65af358acf50e120546310e4a5321df9ea2 SHA-256: cefed001ffce23759cd855160d7121047a9e7ca28fcc633e661521aa20b0e23d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a redirector URL, which is a common tactic for phishing and malware distribution. The document body, though heavily obfuscated, contains the same lure text as the malicious URL, indicating an attempt to trick the user into clicking the link. The presence of numerous external PDF links also suggests a link farm, often used for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=the+quintessential+quintuplets+season+2+episode+1 In PDF document text
    • https://cdn-cms.f-static.net/uploads/4371495/normal_5f8b0bda155f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383131/normal_5f96e0484a2e1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367287/normal_5f8762eb75ad5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366405/normal_5f893f066c453.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369626/normal_5f91ac53c28a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367004/normal_5f87315031d4b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368758/normal_5f8b21726f907.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366335/normal_5f885f2f5d838.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380681/normal_5f8dd2fe281d8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365525/normal_5f86ffaba623f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375694/normal_5f8d3fe8a35a1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410004/normal_5f97651c3050b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jepavilutabilel/kipakikawafovomogovexirav.pdfIn PDF document text
    • https://s3.amazonaws.com/jutenojamega/gisufaduledal.pdfIn PDF document text
    • https://s3.amazonaws.com/tadovu/aviation_safety_standards.pdfIn PDF document text
    • https://s3.amazonaws.com/wumodukubaru/64217682574.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ee240dc-8623-41f9-a726-5c3e7463ccc9/dakogamigolomumobufut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d99a74c0-395a-4422-85a0-162774556179/63036543649.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abdedd6a-6dde-42a1-992e-34be32466296/fenawoputojamomupasodugo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0504/9181/8154/files/69751921362.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/2044/3045/files/bamij.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/3846/6467/files/communication_skills_course_book.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0506/4327/1830/files/voxotuxar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000091b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91B7 4508 bytes
SHA-256: 3a7c87635a8e61566ebb68a5e4d278595a9d59c9fb709eeacde235e440497a77
font_01_sfnt_off0000a193.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA193 5208 bytes
SHA-256: fa10c83550ba49f8e7e86e64311581a488c2fa42759fc3b99919cd19fe203447
font_02_sfnt_off0000b345.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB345 10964 bytes
SHA-256: abf7a7f5b6a8fcc0873e9c08b7d6713a34ba3ae5da443d24b150e1dcb599b18c

Open this report in the interactive analyzer, or submit your own file for analysis.