Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6a0f82a77359f94…

MALICIOUS

PDF

43.5 KB Created: 2020-10-25 01:24:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 03c9ffb6b7eaa95eaa41ff26cbe6e0c9 SHA-1: 0f3e1a7efda49da0323c0dbd9e613721e7854564 SHA-256: e6a0f82a77359f942ee027fea9a2f441d8df3c7c52f1b26d0f2d9c2b7a5c6e38
152 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying one as a known malicious redirector. The document body, though heavily obfuscated, contains a URL that matches the one identified by the heuristic. This suggests the PDF is designed to redirect users to malicious sites, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=all+algebraic+formula+pdf In PDF document text
    • https://bukusafirede.weebly.com/uploads/1/3/4/2/134266240/kixunemovakajam-ziwigejuzagiso-doxebivo-joniforezape.pdfIn PDF document text
    • https://pukejuzim.weebly.com/uploads/1/3/4/4/134457080/keseraw-bewet-jefofis.pdfIn PDF document text
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/roriturosiw.pdfIn PDF document text
    • https://viweposedijul.weebly.com/uploads/1/3/1/0/131070314/dapolawebufazu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/65b0eb88-5d43-41ea-9d21-45cead3b7a90/cuadernos_digitales_aula_31.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d4ffdac-8b16-4286-9881-9a5e76d8d0a1/21141737581.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbfb8531-7897-454c-bb58-b0061f84a029/58262142684.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a6cb5bc-37c5-46ce-8785-344cdc8c8179/60843081669.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7a53208-89f6-4b98-9454-5e7498fd4d77/91850765095.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d8055a5-6a72-4e6a-910d-ac2782c730c6/betarawasanuj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd3979f0-306f-4129-9c5a-c45262327a8e/high_school_student_information_sheet_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca4fff5a-f53b-4b40-b2c4-a6f5a07e654c/69563655845.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef93c3b4-95c0-4d89-9791-d8b225a61eee/phim_le_hong_kong_long_tieng_moi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89da599c-b470-4cf9-8f67-05a94b8183fe/adresse_cpam_foix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/007a5198-8923-4742-8733-cb043bf3f798/pavudoxolodutarixaxewija.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/5354/5632/files/home_sweet_home_design_mod_apk.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/0429/7375/files/21854198940.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/urdu_alphabet_writing_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/tabobujimo/dinastiyang_politikal.pdfIn PDF document text
    • https://s3.amazonaws.com/robumuduluwise/warenu.pdfIn PDF document text
    • https://s3.amazonaws.com/bitajemisajoz/flight_of_the_bumblebee_sheet_music_piano.pdfIn PDF document text
    • https://s3.amazonaws.com/bewibiwat/raberilosedop.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007f26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F26 5428 bytes
SHA-256: 8414c9cf488059649e3a137e635b21257085294db2ed9c84bb20b150fdf34cbb
font_01_sfnt_off00009189.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9189 10120 bytes
SHA-256: 26f17356750ee6f1280ad67938f34a136fe00d6ba3acd0a7a70b5b467e34ef91

Open this report in the interactive analyzer, or submit your own file for analysis.