Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2531ec510fb2343…

MALICIOUS

PDF

71.8 KB Created: 2020-11-25 20:29:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4204fb82b560145b434c2ece9eaf8c03 SHA-1: 4f29bcce5082ffe2f657fca22976abf1b004c153 SHA-256: d2531ec510fb2343cae87fd6f7605f90b91cc4c6c88f4e0fe4a82f4cc3713357
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a link farm, pointing to a URL that appears to be a lure. The document body, though heavily obfuscated, contains text related to 'starting point leaders' and the authoring application 'wkhtmltopdf', suggesting an attempt to manipulate search engine results or direct users to a malicious site. The presence of numerous external links, many of which are to PDFs hosted on strikinglycdn.com, further supports the link farm hypothesis.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=starting+point+leaders
    • https://cdn-cms.f-static.net/uploads/4464055/normal_5fb758b04dda3.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/351950.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/7f5640d9-9802-4e21-b812-fe681efc363f/life_is_feudal_forest_village_field_size.pdf
    • https://uploads.strikinglycdn.com/files/640e05c3-d728-43bc-9307-dade4fe79eec/mapowawufuwakegugumuraxil.pdf
    • https://uploads.strikinglycdn.com/files/b6cdd285-a652-49c0-99d3-4ca0949646bf/9790717208.pdf
    • https://uploads.strikinglycdn.com/files/44996659-dd3c-4f0c-b0cb-719d7ed5ccaa/juwukizazevazemiduzimev.pdf
    • https://uploads.strikinglycdn.com/files/772c8834-08ea-4a16-9cf2-3364a17ae09a/driverpack_solution_offline_highly_compressed.pdf
    • https://uploads.strikinglycdn.com/files/8ab0a368-3d71-44ff-b924-bc78639a6578/super_smash_flash_2_beta_1.2_game.pdf
    • https://uploads.strikinglycdn.com/files/e9b45067-26d0-4e48-afcf-a873750d6e11/lockwood_elementary_school_los_angeles.pdf
    • https://uploads.strikinglycdn.com/files/7f5e8a4c-6be9-4656-8ec6-135e9e9afde9/european_war_4.pdf
    • https://uploads.strikinglycdn.com/files/32e77301-826a-4895-87de-02424ff98ee2/34523687832.pdf
    • https://s3.amazonaws.com/risalenefazozo/64805049079.pdf
    • https://uploads.strikinglycdn.com/files/550f05bb-1042-4073-88d1-2fbb44cad375/midobekud.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cde0.bin
2d929a8104f937e6d8b3302c6d8e3b63327fc4cc05184b080106a7e712b607b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDE0 5016 bytes
font_01_sfnt_off0000dee8.bin
8837be514b1eac93cd9605cb860ca2daa286df11e55384c205588cc7ababdf6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEE8 10632 bytes
font_02_sfnt_off00010323.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10323 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.