Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfc4b551bd5019b7…

MALICIOUS

PDF

47.1 KB Created: 2020-10-10 18:39:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: b7d94c4daa9c0bb953a7da0851fedbfe SHA-1: 276116330902961fd47e6728a07c5c34abcfb4e8 SHA-256: cfc4b551bd5019b70b27ff9cdeff8a369fa2a9bca9aa261d4b2f27b7889e8eab
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, with several pointing to known malicious redirectors and link farms. The ML classifier strongly indicated maliciousness. The document body, though heavily obfuscated, contains URLs that are also present in the heuristics, reinforcing the malicious intent of directing users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?keyword=jacob+kounin+classroom+management In PDF document text
    • http://files.intimatelyyoursweddings.com/uploads/1/3/1/8/131871979/veseje-bolubomelo-tipekubu.pdfIn PDF document text
    • http://paruv.gibdevelopments.com/uploads/1/3/1/8/131856590/suworakev-pugilujurime-mekedo-kojaxetufeni.pdfIn PDF document text
    • http://files.funghidellorba.net/uploads/1/3/2/7/132710780/xelidemubesaju.pdfIn PDF document text
    • http://files.web3iot.com/uploads/1/3/0/8/130814288/2853099.pdfIn PDF document text
    • http://files.portraitsdepros.com/uploads/1/3/1/3/131380901/3a4efedad2f3bae.pdfIn PDF document text
    • https://site-1041583.mozfiles.com/files/1041583/1981226081.pdfIn PDF document text
    • https://site-1037829.mozfiles.com/files/1037829/vunasa.pdfIn PDF document text
    • https://site-1037175.mozfiles.com/files/1037175/70928843211.pdfIn PDF document text
    • https://site-1044162.mozfiles.com/files/1044162/16076875422.pdfIn PDF document text
    • https://site-1036655.mozfiles.com/files/1036655/77114653702.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0466/3200/9893/files/488360798.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/0711/3373/files/astro_a40_manual_firmware_update.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/7921/4265/files/mogemuji.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0482/8997/2385/files/xanoruwogujo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0488/3185/6805/files/rivejowig.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/baf8d3bf-f76c-4ebc-a4d8-90c833f9444c/wujoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5529a654-a80e-4528-92b8-5774e6456b07/fomomobudezazanepabilemo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/351e7032-4d22-4394-a55f-d41ebc432976/kazuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42c43565-e449-4a09-a9d7-138b44118f7b/17239403444.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B1B 5312 bytes
SHA-256: 06d10b379aa7337d66ef4e8ca09fc90d1d256b569a0ee30d983ab4a453c04956
font_01_sfnt_off00008d09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D09 10040 bytes
SHA-256: 87feabccb12ff966ea2127e949e442a80b5e2b8afc050f8678fadcb86209d36a

Open this report in the interactive analyzer, or submit your own file for analysis.