Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed35156d4ec1a874…

MALICIOUS

PDF

46.6 KB Created: 2020-10-16 08:40:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: fefcd8e098e237e204b1caec5afdbfea SHA-1: 752c195ff8fc54d4e48450ff24332bc962ebf61d SHA-256: ed35156d4ec1a874c0cb8fcb306674239e4b4fcd83da86ba1bdc6e76ea64ab6c
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links, including one pointing to a known malicious redirector infrastructure. The document body, though heavily obfuscated, includes the target URL and appears to be a lure related to academic content. The ML classifier strongly indicated maliciousness, and the PDF structure suggests a link farm designed to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?keyword=contending+theories+of+international+relations+dougherty+pdf In PDF document text
    • https://kenilajapa.weebly.com/uploads/1/3/1/0/131069910/4925866.pdfIn PDF document text
    • https://vupimolafi.weebly.com/uploads/1/3/1/3/131398504/939d265826b9b.pdfIn PDF document text
    • https://liwevapazu.weebly.com/uploads/1/3/1/0/131071299/4fd30b.pdfIn PDF document text
    • https://vibebivenef.weebly.com/uploads/1/3/1/4/131412032/pebuxoz.pdfIn PDF document text
    • https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/ruxozukozuvazu.pdfIn PDF document text
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3731638.pdfIn PDF document text
    • https://narogigadi.weebly.com/uploads/1/3/0/8/130874066/xanurugokevun-numimadum-zulomegivadifa-vosokufusibe.pdfIn PDF document text
    • https://purolejomi.weebly.com/uploads/1/3/0/7/130776639/3370382.pdfIn PDF document text
    • https://pukotegifo.weebly.com/uploads/1/3/0/8/130874060/wiwakop.pdfIn PDF document text
    • https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/baputedev.pdfIn PDF document text
    • https://sepenunaxob.weebly.com/uploads/1/3/0/7/130776074/ac845938f56999d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/3408/3996/files/82825008262.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0496/0675/4470/files/basaglar_package_insert.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/8660/1120/files/turkey_run_inner_tubing.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/7488/6563/files/paulo_coelho_libros_gratis_11_minutos.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/6419/9841/files/52020704320.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0504/4125/7110/files/luparo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0498/2118/8251/files/laludusebevajaso.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/2379/4339/files/bio_enzymes_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d55e267a-a673-4cdf-98b1-f18364c22e69/58941718958.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1afdd653-3922-4489-b3b8-8a6db6cc2449/zobibabenorajafarowuw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7de736f6-9a1d-4f3a-8acb-5277e56c040d/vuvijukotidasoxolafera.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/413bcccc-873b-4217-bed7-604253fb4faa/92202852142.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63972abe-20a2-4bab-9d2d-805b5d45193e/5302069440.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000073b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73B7 5308 bytes
SHA-256: 1b93eb77d79b6cfae08bc337777876219432d2df64784a48576a1cdec5f5959e
font_01_sfnt_off000085c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85C4 11880 bytes
SHA-256: 804f599b500f63d427b4019951a98a7e4380e9b478d410be9b36ae1d88ba07af

Open this report in the interactive analyzer, or submit your own file for analysis.