Malicious PDF — malware analysis report

Static analysis result for SHA-256 e99792d4273aec78…

MALICIOUS

PDF

40.0 KB Created: 2020-10-29 11:40:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 94fd1ba5c944ed49ad3747fb86cbd3a2 SHA-1: 758cd6d5cd882029971cd21f52a5b0da925a0e58 SHA-256: e99792d4273aec78b3ce80d8fa56e1de6a792f3be6b75e7b3d25f68e7ad76526
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many of which point to external resources, including a known malicious redirector. The document body text, though garbled, includes a keyword related to 'Pekingese for sale in houston' and a URL that is also present in the embedded link farm. This suggests a phishing or scam attempt designed to redirect users to malicious infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/aws?keyword=pekingese+for+sale+in+houston
    • https://jonukejunuxesa.weebly.com/uploads/1/3/1/4/131409236/nazepapoleser-kebugefe-temuxaporazoj.pdf
    • https://wavutokemik.weebly.com/uploads/1/3/4/3/134309613/f607df5b0711b3.pdf
    • https://jemiwuwavaza.weebly.com/uploads/1/3/0/8/130814288/bibesekukemugedovofa.pdf
    • https://pejopazuzaguwoz.weebly.com/uploads/1/3/2/8/132815183/8225521.pdf
    • https://zuvagenujak.weebly.com/uploads/1/3/4/4/134454716/mobadetatuj_vaber.pdf
    • https://mufalugibesenu.weebly.com/uploads/1/3/1/4/131453255/zodafapinizu.pdf
    • https://mogijoduvide.weebly.com/uploads/1/3/0/8/130814471/8970623.pdf
    • https://pexazunawilaga.weebly.com/uploads/1/3/4/2/134265520/1265571.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vazisi/speaking_english_notes.pdf
    • https://s3.amazonaws.com/vuraradaso/enterprise_risk_management_free_download.pdf
    • https://s3.amazonaws.com/wonoti/geographical_map_of_usa.pdf
    • https://s3.amazonaws.com/fasanag/99250864629.pdf
    • https://s3.amazonaws.com/gupuso/62127326360.pdf
    • https://s3.amazonaws.com/forupokisip/xeludisajisagujipudoli.pdf
    • https://cdn.shopify.com/s/files/1/0488/1642/3077/files/19572150504.pdf
    • https://s3.amazonaws.com/tuzamada/faviwa.pdf
    • https://s3.amazonaws.com/fuwawibu/41499368765.pdf
    • https://cdn.shopify.com/s/files/1/0492/3886/8124/files/41177299919.pdf
    • https://s3.amazonaws.com/guvovigo/vofipafebunazenaluwot.pdf
    • https://s3.amazonaws.com/felasorarabipis/office_assistant_duties.pdf
    • https://cdn.shopify.com/s/files/1/0471/0678/5430/files/pidiwiginerixogejatitos.pdf
    • https://cdn.shopify.com/s/files/1/0268/7624/8250/files/michael_kors_parker_mother_of_pearl_watch.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005df2.bin
e86d0bd63768696bfb77678bed96f2a6b58ce270592a938ba840c84cc3642a21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DF2 5096 bytes
font_01_sfnt_off00006f44.bin
b2d01f9b38a44bbe999f32aeee5fa8963d0cead5ed070e93e43a8de604993572		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F44 10528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.