Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9d47e995f62ee7b…

MALICIOUS

PDF

41.9 KB Created: 2020-11-08 03:12:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 4b3cc008fe6b07efcdd96a3453f607c9 SHA-1: 26dc8c9d89b55b0812f99ab8bfba467eb3e35d2e SHA-256: e9d47e995f62ee7b97109606eb93290b81e93a038cb146373bac92d399b29f57
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?keyword=7%252F435+%253D+0.016091954022989 In PDF document text
    • https://gigijegijozi.weebly.com/uploads/1/3/4/4/134400985/savibilaruzasos-vuzowix.pdfIn PDF document text
    • https://gatofofuxiwiv.weebly.com/uploads/1/3/4/2/134265530/1817846.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xovekolamoxe/jereboz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5866a3ca-c4e0-423e-8a99-12cf675c515f/3865199893.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11443954-7491-48e9-88c5-aaeff164a6d1/lebovasus.pdfIn PDF document text
    • https://vixorujedujo.files.wordpress.com/2020/11/loxebigigarug.pdfIn PDF document text
    • https://xaxojisepi.files.wordpress.com/2020/11/94870274191.pdfIn PDF document text
    • https://fewenepigat.files.wordpress.com/2020/11/jezokidakabiv.pdfIn PDF document text
    • https://s3.amazonaws.com/dumupa/mua_medical_school_reddit.pdfIn PDF document text
    • https://s3.amazonaws.com/nemafu/wupuwokilunafane.pdfIn PDF document text
    • https://s3.amazonaws.com/lupebesu/illusion_gif_wallpaper.pdfIn PDF document text
    • https://s3.amazonaws.com/vedexajawo/data_structures_and_algorithms_programs_in_c.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000056fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56FB 5468 bytes
SHA-256: 14e8bce5c41b86e996318ffb2f6e369024c0abadb0ab55cecc06a16c33f086c0
font_01_sfnt_off0000698d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x698D 6244 bytes
SHA-256: 7a7eb2e82a943a018aed887114b7e79c207a2f2307cd95c19e638198d389fbfa
font_02_sfnt_off000078c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x78C5 9832 bytes
SHA-256: 73d3ee6eb8a6a87d8d3a66127579c8a5a6a5ea22575748a10d67166828f3d2ec

Open this report in the interactive analyzer, or submit your own file for analysis.