Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0310204b15a687b…

MALICIOUS

PDF

85.0 KB Created: 2020-11-06 04:17:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: b2127cefffc7e7defd2fb7b53ac23f3a SHA-1: deb8222423ad2bffc2a162e492cca4f268572e95 SHA-256: e0310204b15a687b8ec64f97d88cfb920cadcc28e4032b7e0dce29c98bc54151
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=roblox+piano+sheet+music In PDF document text
    • https://cdn-cms.f-static.net/uploads/4415531/normal_5f985dbfa1a19.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371248/normal_5f8e8c194ad22.pdfIn PDF document text
    • https://xotuwajugi.weebly.com/uploads/1/3/4/3/134349857/fb9636106024.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425504/normal_5f9da4a88983d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379973/normal_5f9d560071706.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393754/normal_5f96c6c3dab3a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374715/normal_5f8cbcaf5ea48.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tudawufed/ccna_voice_quick_reference.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e9e87aa-4173-4d78-b5e6-937b433548f6/solururibiwo.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/45913577221.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/7673/0528/files/87973049439.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ca673c7-f37d-4d63-b70c-4af9a7956f27/zogifomiwuzoloje.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/3141/3415/files/gapamajetexufaxeworudaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a34377b1-c9ea-4a22-9f67-b8f9658753a7/35185522645.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b3ffcc0-3060-4fe7-8ad8-b800481d4fe8/nobulezu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f45a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF45A 5292 bytes
SHA-256: b09598691c0c45aebfbcaa06b44d1dc970cc4a8f3cc4b11a95192628a84dd247
font_01_sfnt_off0001063a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1063A 13212 bytes
SHA-256: 36af2657514101d28323ad86a02b61ae847292600ff92b07667386449dba14a4
font_02_sfnt_off0001305f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1305F 16660 bytes
SHA-256: 682a406efcdf7dd49f9c494c129bca6394f160b3e372cc4ba493723cd6bcd7e0

Open this report in the interactive analyzer, or submit your own file for analysis.