Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3c32ce65a9e091f…

MALICIOUS

PDF

41.8 KB Created: 2020-10-29 08:19:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 88a95efe09ed17de5501218bdbe25162 SHA-1: 3d5959d7b898a194e685c4d4e8bf351ef1a897da SHA-256: e3c32ce65a9e091f4fdb48e7ca44dc2bc76e8de6658b7ad63f4393ec67b3c930
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links, many pointing to external PDF files, suggesting a link farm or SEO poisoning attempt. One critical heuristic identified a link to known malicious redirector infrastructure. The document body, though heavily obfuscated, contains a URL that is also present in the heuristics and IOCs, indicating a likely attempt to redirect the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/123?keyword=line+plot+powerpoint In PDF document text
    • https://seborokib.weebly.com/uploads/1/3/4/0/134096410/mamolisup_dimatakono_zobes.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393499/normal_5f90e587f195f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368494/normal_5f87b371aabff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408718/normal_5f9a5694d92d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367961/normal_5f89dfc1e6460.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372086/normal_5f93d5fc85935.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385028/normal_5f8d34bb119ce.pdfIn PDF document text
    • https://fisizupesaxog.weebly.com/uploads/1/3/1/6/131636899/zizelaruvefejad-vasuf-fokuxezufewox.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384836/normal_5f92630080c1c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407793/normal_5f97cef74fbba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384480/normal_5f8e84fee3c7e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365575/normal_5f8c07af3f603.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/2988/7645/files/vunewufigad.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0486/6424/8470/files/jikunelolowesenavide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/1155/3473/files/vabizi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bb8df60-0e58-4048-b244-3f8cf49b13ee/30114854108.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f34e1fc4-a774-4602-8e5b-c57abf1a95f5/mugepatubiduw.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/3880/1063/files/physical_education_annual_plan.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/4515/9580/files/ebony_blade_skyrim_glitch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/514aea82-76c5-48ba-a2e3-39520d91511a/fujuborubovuginema.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb9878d3-f67c-48b4-b6c7-28fbdd4e5562/820255179.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d68163d1-94d1-49bf-a4dd-1942bac30e67/69416297623.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000677d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x677D 4460 bytes
SHA-256: c77bc2068ee7ac4dcc79d322f9a5c75e1b4fcc5e5e71e4fae15b2faeb733b6d5
font_01_sfnt_off000076c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76C4 10256 bytes
SHA-256: bbf23908b045d0b5d051bd8db202e6ced4cae7cc6e8e074345deac0510fa7086

Open this report in the interactive analyzer, or submit your own file for analysis.