Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7f20c5fe6547671…

MALICIOUS

PDF

45.9 KB Created: 2020-10-27 19:41:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 491991f79ec55ec5f19df6a6bb55d134 SHA-1: d6b80df4782dc347d01890b959ad93ac0199e3f0 SHA-256: e7f20c5fe6547671bd2fb14bb57df478aea919aa6cf8d6147cb14b054b327dce
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, many of which point to redirector infrastructure like 'ggtraff.ru'. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'San Luis Rey Mission mass times'. The presence of a malicious redirector link and a link farm heuristic strongly suggests an attempt to drive traffic to malicious sites, likely for further exploitation or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=san+luis+rey+mission+mass+times
    • https://cdn-cms.f-static.net/uploads/4366623/normal_5f87474489294.pdf
    • https://cdn-cms.f-static.net/uploads/4404108/normal_5f945c74ef436.pdf
    • https://cdn-cms.f-static.net/uploads/4367019/normal_5f87380203b5f.pdf
    • https://cdn-cms.f-static.net/uploads/4367273/normal_5f9149097f8af.pdf
    • https://soremezu.weebly.com/uploads/1/3/1/0/131070226/rakuvone.pdf
    • https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/bakeloti_tuworonovof_lezafawov.pdf
    • https://fidurelofomus.weebly.com/uploads/1/3/0/7/130740547/xenutisavobokujesi.pdf
    • https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/kujim_wafij_gekiliwad.pdf
    • https://xavujome.weebly.com/uploads/1/3/0/7/130739328/xijawifoliwuw-zarezagex.pdf
    • https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/juzapedewevomup.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bc7ccd6c-4dea-41b4-af08-99c35a5ae684/84429859282.pdf
    • https://uploads.strikinglycdn.com/files/3cdcc03d-3701-4e18-85d2-bb3b34c8a67f/togewokowana.pdf
    • https://uploads.strikinglycdn.com/files/9afe469e-6c4b-48c7-8713-ffdf2d138959/52448707486.pdf
    • https://uploads.strikinglycdn.com/files/5134d67c-686c-41ca-9c74-3d5d59bf2cb6/2780858891.pdf
    • https://uploads.strikinglycdn.com/files/ea3f5919-f53c-4f00-89da-4f72f5421e1b/68206519862.pdf
    • https://s3.amazonaws.com/xanebavifamopez/mesenojafeziredu.pdf
    • https://s3.amazonaws.com/waxapoz/13940521739.pdf
    • https://s3.amazonaws.com/sugowubuf/64275051902.pdf
    • https://s3.amazonaws.com/sevoga/25505317241.pdf
    • https://s3.amazonaws.com/tetazino/69701151288.pdf
    • https://s3.amazonaws.com/memul/metabolismo_de_proteinas_y_aminoacidos_bioquimica.pdf
    • https://s3.amazonaws.com/xanebavifamopez/wuvem.pdf
    • https://s3.amazonaws.com/fikuvine/command_prompt_windows_7_commands.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000732d.bin
61c485da975b0c079aeaf744dcc93a3c37e18f7494927992a7c50f754b957b3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x732D 5036 bytes
font_01_sfnt_off00008434.bin
fb63ef18b60825645b3923891b0739be76082f774a4ac07f6ad98cfdfa05d794		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8434 11280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.