Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2524e23619ba7be…

MALICIOUS

PDF

53.9 KB Created: 2020-11-01 15:56:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2958cdd995e5a4a9e7d8922cac2374a2 SHA-1: 7390c7e1802d6d3e0ab0197364437593f2a89caf SHA-256: e2524e23619ba7be1890bbd3d5443cb9c570639a45bb973c5645b7c944db53d2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which, 'https://gettraff.ru/strik?keyword=affidavit+of+residency+nevada', is flagged as a known malicious redirector. The document body, though heavily obfuscated, contains text related to 'Affidavit of residency nevada' and the same URL, suggesting a lure. The presence of numerous external PDF links, including a large link farm, further indicates malicious intent, likely for SEO poisoning or driving traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=affidavit+of+residency+nevada
    • https://cdn-cms.f-static.net/uploads/4380867/normal_5f9258da79214.pdf
    • https://zatazonikafude.weebly.com/uploads/1/3/4/3/134340422/d658f0821189.pdf
    • https://cdn-cms.f-static.net/uploads/4383146/normal_5f93de338b14c.pdf
    • https://cdn-cms.f-static.net/uploads/4403947/normal_5f9466b8d61b0.pdf
    • https://cdn-cms.f-static.net/uploads/4410186/normal_5f9d05de018a8.pdf
    • https://cdn-cms.f-static.net/uploads/4375515/normal_5f9be943774e5.pdf
    • https://cdn-cms.f-static.net/uploads/4375352/normal_5f8e18d2789b0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wixanarer/catalogo_ngk_2019.pdf
    • https://s3.amazonaws.com/sinadi/motorasabipijiliregirula.pdf
    • https://s3.amazonaws.com/zifozujiwi/voninir.pdf
    • https://s3.amazonaws.com/remoxi/dried_cranberries_for_dogs_uti.pdf
    • https://uploads.strikinglycdn.com/files/88dcba1b-11f2-4bdb-b583-4bd5f171043e/mensagem_de_santa_claus_para_meninos.pdf
    • https://s3.amazonaws.com/vifusupegiza/attach_in_word_mail_merge.pdf
    • https://s3.amazonaws.com/debamijizozexo/blackfin_walkie_talkie_solar_power_kit_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000a25d.bin
402a1a8449154e42c5cc6ac5fed4193e0c038d87d794db4a58087ddce560bacd		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA25D 22880 bytes
font_00_sfnt_off00006e59.bin
d900ee4b6d8434c0de871a49409f4991dc194ea7ed3f90479d05de74572bbd26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E59 5136 bytes
font_01_sfnt_off00007ff2.bin
cd65ff0f7b07b2747852a3c09f26c9a35ef725b9fcfe8237f32872083c490dee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FF2 10104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.