Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4f4097d0f76fd89…

MALICIOUS

PDF

41.5 KB Created: 2020-10-26 20:30:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: f2c018d21bc048bacfe450fdf4e65a78 SHA-1: 2d54aedfa014d780faa6e21974c52e89713325f4 SHA-256: e4f4097d0f76fd89c99babf5c545808f4f43cc72fa28295eff9c103e06e51250
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains a large number of embedded links, many of which point to redirector infrastructure and link farms. The primary heuristic indicates that the PDF links to known malicious redirector infrastructure, and another heuristic identifies it as a link farm. The embedded links likely serve to direct users to malicious sites, potentially for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=sailor+moon+princess+diana In PDF document text
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3808383.pdfIn PDF document text
    • https://rivisoni.weebly.com/uploads/1/3/0/7/130739016/7637698.pdfIn PDF document text
    • https://sizukejagu.weebly.com/uploads/1/3/2/6/132681884/b9ede8cb5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403823/normal_5f91428220d9d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373753/normal_5f895c8a63e05.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366324/normal_5f8bd11a8af95.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365542/normal_5f8748810ed36.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405907/normal_5f95bc18967bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377120/normal_5f89df8e143b9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369518/normal_5f8dd12d3a3d1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/susopuzupure/wisusozu.pdfIn PDF document text
    • https://s3.amazonaws.com/libeganot/velozusetadevofogisaziva.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/blue_eyes_song_lyrics_download.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/fokuwurorozeg.pdfIn PDF document text
    • https://s3.amazonaws.com/sugaguxagu/occupational_health_management.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/detuvesuxamuki.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/6019/1651/files/lipsy_london_dress_size_guide.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/7214/2497/files/fable_anniversary_prima_official_game_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63D6 5324 bytes
SHA-256: 71eadd0f63a958bb4bf74b8893704127bdccbe5070569b5c842a10424fa605a8
font_01_sfnt_off000075c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75C0 10340 bytes
SHA-256: f9376149bb2653249612bafc5dd8f0064da5aea8ee03de6b9a551a95ca9fb419

Open this report in the interactive analyzer, or submit your own file for analysis.