Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7f7d492e76996ee…

MALICIOUS

PDF

65.0 KB Created: 2020-10-16 07:42:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: facc83f7d9fbfc0a08e58eb48b2ebc46 SHA-1: 703aad1f7ae60a182f2ab73a969b8f26159ad491 SHA-256: d7f7d492e76996eecbf22e465ec701e8c8525d956e40416fc1df8b8756207d72
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded links, many of which point to disposable hosting or known malicious redirectors. The primary malicious link identified is https://cctraff.ru/123?keyword=hum+aapke+hain+koun+movie+video+hd, which is flagged as a redirector to malicious infrastructure. The document's structure and content suggest it's designed to lure users into clicking these links, likely leading to further malware downloads or phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?keyword=hum+aapke+hain+koun+movie+video+hd In PDF document text
    • https://tajurasexir.weebly.com/uploads/1/3/1/6/131606020/govodijix_jarelu.pdfIn PDF document text
    • https://derodaju.weebly.com/uploads/1/3/1/6/131606282/rawabevujoroj.pdfIn PDF document text
    • https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/059d55fbff3.pdfIn PDF document text
    • https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/3cb113af6.pdfIn PDF document text
    • https://vodipewelo.weebly.com/uploads/1/3/1/6/131637384/3298954.pdfIn PDF document text
    • https://bijifejutumaxob.weebly.com/uploads/1/3/1/3/131381781/paterefi_werogi_lafumesob_rumixasenu.pdfIn PDF document text
    • https://dagigokes.weebly.com/uploads/1/3/0/7/130739756/sinafadatumugefuw.pdfIn PDF document text
    • https://viweposedijul.weebly.com/uploads/1/3/1/0/131070314/9a0c341.pdfIn PDF document text
    • https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/dbbd04.pdfIn PDF document text
    • https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/2703260.pdfIn PDF document text
    • https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/3079835.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca0b2a31-75ba-4f04-8555-7e73222f7bde/refidarunuxafowalagumu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1e34bdc-a0e2-45e9-b368-a77342474519/42712900388.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2464473b-3724-4c42-9251-69c748955668/wizunabokozina.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0005be7-b432-4ed1-8880-96ba84c8be08/41196816679.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea842089-aa5f-496f-88b5-ff03928b267d/50049867796.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0465/0768/8086/files/juvenile_diabetes_awareness_ribbon_color.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/4971/3817/files/types_of_seagulls_in_virginia.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/3510/7233/files/84995543946.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25a6a0c5-cbe5-424e-b9c8-d72f178c9c9f/duvur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8474c4af-3032-4778-8e8a-41f09b6a9ea6/fefamogusutogibixar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aa68.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAA68 4976 bytes
SHA-256: eefb6faf55965d50536b2f36cc8483e8fe912d3eeb7751fbd7d535183026dda6
font_01_sfnt_off0000bb39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB39 10908 bytes
SHA-256: 6573cb712647d3c8f08bd863279df24c0d25d2c6c59122fee5cc8cdc770dfeab
font_02_sfnt_off0000e087.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE087 16164 bytes
SHA-256: 4bd16c8abd39118228c1571b0005d4eb3b3e943e572fd92a2a80cfcb7b749349

Open this report in the interactive analyzer, or submit your own file for analysis.